Function at 0x140018540
Capabilities:
Create process on windows
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x7a0
mov rax, qword [0x14003b040]
xor rax, rsp
mov qword [rsp + 0x790], rax
mov r12d, ecx
mov dword [rsp + 0x90], ecx
xor r13d, r13d
lea ecx, [r13 + 3]
call qword [sym.imp.libcurl.dll_curl_global_init]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c8], xmm0
mov qword [rsp + 0x1d8], r13
mov qword [rsp + 0x1e0], 0xf
mov byte [rsp + 0x1c8], r13b
call qword [sym.imp.libcurl.dll_curl_easy_init]
mov r14, rax
mov qword [rsp + 0xc0], rax
lea rcx, str.Before_if_curl
call fcn.1400013e0
test r14, r14
je 0x140019b0d
mov rdx, qword [0x14003b100]
movabs rbx, 0x7fffffffffffffff
mov rcx, rbx
sub rcx, rdx
cmp rcx, 0xe
jb 0x140019b85
lea rax, [0x14003b0f0]
cmp qword [0x14003b108], 0xf
cmova rax, qword [0x14003b0f0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xe
lea r9, str.x_access_key:
lea rcx, [rsp + 0x250]
call fcn.140005bb0
nop
mov rcx, qword [0x14003b140]
sub rbx, rcx
cmp rbx, 0x10
jb 0x140019b8b
lea rax, [0x14003b130]
cmp qword [0x14003b148], 0xf
cmova rax, qword [0x14003b130]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x10
lea r9, str.x_access_token:
lea rcx, [rsp + 0x1e8]
call fcn.140005bb0
nop
lea rdx, [rsp + 0x250]
cmp qword [rsp + 0x268], 0xf
cmova rdx, qword [rsp + 0x250]
xor ecx, ecx
call qword [sym.imp.libcurl.dll_curl_slist_append]
lea rdx, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 0xf
cmova rdx, qword [rsp + 0x1e8]
mov rcx, rax
call qword [sym.imp.libcurl.dll_curl_slist_append]
lea rdx, str.Expect_:
mov rcx, rax
call qword [sym.imp.libcurl.dll_curl_slist_append]
mov rbx, rax
lea rcx, str.Start_curl_n
call fcn.1400013e0
lea rcx, [rsp + 0x168]
call fcn.140010fe0
cmp qword [rax + 0x18], 0xf
jbe 0x140018705
mov rax, qword [rax]
mov r8, rax
lea rdx, str.http:___s_api_support_files
lea rcx, [rsp + 0x360]
call fcn.1400014c0
mov rdx, qword [rsp + 0x180]
cmp rdx, 0xf
jbe 0x140018762
inc rdx
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001875d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001875d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
lea r8, [rsp + 0x360]
mov edx, 0x2712
mov rcx, r14
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov edx, 0x4e
lea r8d, [rdx - 0x4a]
mov rcx, r14
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [0x1400165b0]
mov edx, 0x4e2b
mov rcx, r14
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [rsp + 0x1c8]
mov edx, 0x2711
mov rcx, r14
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov r8, rbx
mov edx, 0x2727
mov rcx, r14
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov rcx, r14
call qword [sym.imp.libcurl.dll_curl_easy_perform]
movsxd r15, eax
mov dword [rsp + 0x60], r15d
test eax, eax
je 0x1400188bd
lea rdx, str.error
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004e10
mov edx, r15d
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140004fe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Error_tai_dap_an_PE:
add rdx, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
mov qword [rsp + 0x158], r13
mov qword [rsp + 0x160], r13
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp byte [rdx + rsi], 0
jne 0x140018840
mov r8, rsi
lea rcx, [rsp + 0x148]
call fcn.140005420
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x168]
call fcn.14000f840
mov rdx, qword [rsp + 0x180]
cmp rdx, 0xf
jbe 0x140019a5d
inc rdx
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400188b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400188b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
jmp 0x140019a5d
lea rbx, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 0xf
cmova rbx, qword [rsp + 0x1c8]
mov rax, qword [rsp + 0x1d8]
cmp rax, 4
jb 0x140018965
lea rdi, [rbx + rax]
lea r8, [rdi - 3]
sub r8, rbx
mov edx, 0x6e
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x140018965
lea rsi, str.null
mov rcx, r13
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x140018939
cmp rcx, 4
jne 0x140018920
mov eax, r13d
jmp 0x14001893e
sbb eax, eax
or eax, 1
test eax, eax
je 0x140018b2c
inc r9
lea r8, [rdi - 3]
sub r8, r9
mov edx, 0x6e
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140018910
lea rdx, str.dIT_ME_MAY
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004e10
lea rdx, [0x140004fe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x210], xmm0
movups xmmword [rsp + 0x240], xmm0
mov qword [rsp + 0x218], r13
movdqa xmmword [rsp + 0x220], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x230], xmm1
mov qword [rsp + 0x240], r13
mov byte [rsp + 0x248], 0
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0xc8]
call fcn.140004ae0
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.14000ace0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x270], xmm0
movups xmmword [rsp + 0x280], xmm0
movups xmmword [rsp + 0x290], xmm0
movups xmmword [rsp + 0x2a0], xmm0
movups xmmword [rsp + 0x2b0], xmm0
mov qword [rsp + 0x2c0], rax
movups xmmword [rsp + 0x148], xmm0
mov qword [rsp + 0x158], r13
mov qword [rsp + 0x160], r13
lea r8d, [rax + 4]
lea rdx, str.data
lea rcx, [rsp + 0x148]
call fcn.140005420
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x210]
call fcn.14000ae30
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
mov qword [rsp + 0x138], r13
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], 0
mov rax, qword [rsp + 0x2b8]
mov rdx, qword [rsp + 0x2b0]
sub rax, rdx
sar rax, 5
test eax, eax
jle 0x140019106
lea rcx, [rsp + 0x168]
call fcn.140004ae0
nop
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0xc8]
call fcn.140004ae0
mov rdx, rax
lea rcx, [rsp + 0x270]
call fcn.14000ace0
nop
mov rdx, qword [rsp + 0x180]
cmp rdx, 0xf
jbe 0x140018b4f
inc rdx
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018b4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018b4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
sub r9, rbx
cmp r9, 0xffffffffffffffff
je 0x140018965
lea rcx, str.Khong_tim_thay_file_PE_zip_tren_server_n
call fcn.1400013e0
jmp 0x140019a5d
call fcn.14002606c
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a8], xmm0
mov qword [rsp + 0x1b8], r13
mov qword [rsp + 0x1c0], r13
mov r8d, 3
lea rdx, [0x14003152c]
lea rcx, [rsp + 0x1a8]
call fcn.140005420
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x148]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
mov qword [rsp + 0x158], r13
mov qword [rsp + 0x160], 0xf
mov byte [rsp + 0x148], 0
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0xc8]
call fcn.140004ae0
nop
lea r9, [rsp + 0x148]
mov r8, rax
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x270]
call fcn.140023fe0
nop
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 0xf
jbe 0x140018c45
inc rdx
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018c40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018c40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
mov qword [rsp + 0x1b8], r13
mov qword [rsp + 0x1c0], 0xf
mov byte [rsp + 0x1a8], 0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0xf
jbe 0x140018ca7
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018ca2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018ca2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
movups xmm2, xmmword [rsp + 0x168]
movups xmmword [rsp + 0x128], xmm2
movups xmm1, xmmword [rsp + 0x178]
movups xmmword [rsp + 0x138], xmm1
mov eax, r13d
mov rsi, 0xffffffffffffffff
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r12, xmm0
movq rdi, xmm1
movq r15, xmm2
mov dword [rsp + 0x88], eax
movsxd rcx, eax
cmp rcx, rdi
jae 0x14001909f
lea rax, [rsp + 0x128]
cmp r12, 0xf
seta r13b
cmova rax, r15
cmp byte [rax + rcx], 0x5c
jne 0x140018f2c
lea r14, [rsp + 0x128]
test r13b, r13b
cmovne r14, r15
test rdi, rdi
je 0x140018d4b
mov r8, rdi
mov edx, 0x5c
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140018d4b
sub rbx, r14
jmp 0x140018d4e
mov rbx, rsi
cmp rbx, 0xffffffffffffffff
je 0x140018f2c
lea rcx, [rbx + 1]
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
xor r14d, r14d
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
cmp rdi, rcx
jb 0x140019b91
sub rdi, rcx
mov r8, rsi
cmp rdi, rsi
cmovb r8, rdi
lea rdx, [rsp + 0x128]
test r13b, r13b
cmovne rdx, r15
add rdx, rcx
lea rcx, [rsp + 0xa0]
call fcn.140005420
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
mov qword [rsp + 0x158], r14
mov qword [rsp + 0x160], r14
cmp qword [rsp + 0x138], rbx
cmovb rbx, qword [rsp + 0x138]
lea rdx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rdx, qword [rsp + 0x128]
mov r8, rbx
lea rcx, [rsp + 0x148]
call fcn.140005420
nop
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x148]
lea rcx, [rsp + 0x168]
call fcn.1400059c0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0xf
jbe 0x140018e6a
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018e65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018e65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
movups xmm0, xmmword [rsp + 0x168]
movups xmmword [rsp + 0x128], xmm0
movups xmm1, xmmword [rsp + 0x178]
movups xmmword [rsp + 0x138], xmm1
mov rdx, qword [rsp + 0x160]
cmp rdx, 0xf
jbe 0x140018ed1
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018ecb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018ecb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x140018f14
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018f0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019989
call fcn.14002606c
mov r15, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x138]
mov r12, qword [rsp + 0x140]
lea r14, [rsp + 0x128]
cmp r12, 0xf
seta byte [rsp + 0x50]
cmova r14, r15
cmp rdi, 8
jb 0x14001908c
lea rax, [rdi - 8]
mov qword [rsp + 0x58], rax
lea r13, [rax + r14]
lea r8, [r13 + 1]
sub r8, r14
mov edx, 0x68
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14001908c
nop dword [rax + rax]
mov r8d, 8
lea rdx, str.https:__
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140018fc6
inc rbx
lea r8, [r13 + 1]
sub r8, rbx
mov edx, 0x68
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140018f80
mov eax, dword [rsp + 0x88]
inc eax
jmp 0x140018ce9
sub rbx, r14
cmp rbx, 0xffffffffffffffff
je 0x14001908c
lea r14, [rsp + 0x128]
cmp byte [rsp + 0x50], 0
cmovne r14, r15
mov rdi, qword [rsp + 0x58]
lea r8, [rdi + 1]
add r8, r14
sub r8, r14
mov edx, 0x68
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14001904b
nop dword [rax + rax]
mov r8d, 8
lea rdx, str.https:__
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001909a
inc rbx
lea r8, [rdi + 1]
add r8, r14
sub r8, rbx
mov edx, 0x68
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140019010
mov rbx, rsi
mov qword [rsp + 0x20], 7
lea r9, str.http:__
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x128]
call fcn.1400217a0
mov r12, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x138]
mov r15, qword [rsp + 0x128]
mov eax, dword [rsp + 0x88]
inc eax
jmp 0x140018ce9
sub rbx, r14
jmp 0x14001904e
lea rdx, str.URL:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004e10
lea rdx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova rdx, qword [rsp + 0x128]
mov r8, qword [rsp + 0x138]
mov rcx, rax
call fcn.140005ef0
lea rdx, [0x140004fe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r14, qword [rsp + 0xc0]
mov r15d, dword [rsp + 0x60]
mov r12d, dword [rsp + 0x90]
xor r13d, r13d
jmp 0x14001910d
mov rsi, 0xffffffffffffffff
inc dword [0x14003c04c]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rdx, rax
lea rcx, [rsp + 0x168]
call fcn.140002180
mov rbx, rax
mov r8d, dword [0x14003c04c]
lea r9, [rsp + 0x1bd]
test r8d, r8d
jns 0x140019190
neg r8d
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140019150
dec r9
mov byte [r9], 0x2d
jmp 0x1400191ba
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140019190
lea r8, [rsp + 0x1bd]
mov rdx, r9
lea rcx, [rsp + 0x108]
call fcn.140005dc0
nop
mov r9d, 4
lea r8, str.code
lea rcx, [rsp + 0x108]
call fcn.140005cd0
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xb0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x140030668]
lea rcx, [rsp + 0xa0]
call fcn.140004c60
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, rbx
lea r8, [rsp + 0x68]
lea rcx, [rsp + 0xe8]
call fcn.1400059c0
nop
mov r8d, 4
lea rdx, str..zip
lea rcx, [rsp + 0xe8]
call fcn.140004c60
xorps xmm0, xmm0
movups xmmword [rsp + 0x188], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x198], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x188], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x198], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x100]
cmp rdx, 0xf
jbe 0x140019317
inc rdx
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019312
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019312
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
movdqa xmm0, xmmword [0x140032180]
movdqu xmmword [rsp + 0xf8], xmm0
mov byte [rsp + 0xe8], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x140019374
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001936e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001936e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x1400193ba
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400193b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400193b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
movdqa xmm0, xmmword [0x140032180]
movdqu xmmword [rsp + 0xb0], xmm0
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0x120]
cmp rdx, 0xf
jbe 0x140019419
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019414
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019414
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
movdqa xmm0, xmmword [0x140032180]
movdqu xmmword [rsp + 0x118], xmm0
mov byte [rsp + 0x108], 0
mov rdx, qword [rsp + 0x180]
cmp rdx, 0xf
jbe 0x140019478
inc rdx
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019473
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019473
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
movdqa xmm0, xmmword [0x140032180]
movdqu xmmword [rsp + 0x178], xmm0
mov byte [rsp + 0x168], 0
cmp r12d, 1
jne 0x140019667
lea rcx, str.________________________DOWNLOAD_PE_FILE___________________n
call fcn.1400013e0
lea r9, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0xf
cmova r9, qword [rsp + 0x188]
lea r8, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova r8, qword [rsp + 0x128]
lea rdx, str._curl__m_15__s__o__s_
lea rcx, [rsp + 0x380]
call fcn.1400014c0
lea rcx, [rsp + 0x380]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rbx, [0x14003b1b0]
mov r9, rbx
cmp qword [0x14003b1c8], 0xf
cmova r9, qword [0x14003b1b0]
lea r8, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0xf
cmova r8, qword [rsp + 0x188]
lea rdx, str.move___s____s_
lea rcx, [rsp + 0x380]
call fcn.1400014c0
lea rcx, [rsp + 0x380]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
mov qword [rsp + 0x158], r13
mov qword [rsp + 0x160], r13
lea r8d, [r12 + 0x14]
lea rdx, str.Da_tai_dap_an_file_PE
lea rcx, [rsp + 0x148]
call fcn.140005420
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x68]
call fcn.14000f840
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x1400195dc
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400195d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400195d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
mov rdx, rbx
cmp qword [0x14003b1c8], 0xf
cmova rdx, qword [0x14003b1b0]
lea rcx, str.File_PE_saved_on_:__s__n
call fcn.1400013e0
mov rdx, rbx
cmp qword [0x14003b1c8], 0xf
cmova rdx, qword [0x14003b1b0]
lea r9, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0xf
cmova r9, qword [rsp + 0x188]
cmp qword [0x14003b1c8], 0xf
cmova rbx, qword [0x14003b1b0]
mov qword [rsp + 0x20], rdx
mov r8, rbx
lea rdx, str._powershell_Expand_Archive__Path__s__s__DestinationPath__s__Force_
lea rcx, [rsp + 0x380]
call fcn.1400014c0
lea rcx, [rsp + 0x380]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x1400198be
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], r13
mov r8d, 0x21
lea rdx, str.Da_tai_dap_an_PE_method_2___wget_
lea rcx, [rsp + 0x68]
call fcn.140005420
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xc8]
call fcn.14000f840
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0xf
jbe 0x1400196eb
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400196e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400196e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x2f4], xmm0
movups xmmword [rsp + 0x304], xmm0
movups xmmword [rsp + 0x314], xmm0
movups xmmword [rsp + 0x324], xmm0
movups xmmword [rsp + 0x334], xmm0
movups xmmword [rsp + 0x344], xmm0
mov dword [rsp + 0x354], eax
mov dword [rsp + 0x2f0], 0x68
movups xmmword [rsp + 0x1a8], xmm0
mov qword [rsp + 0x1b8], rax
movsxd rdx, dword [0x14003c0ac]
shl rdx, 5
lea rax, [0x14003c1f0]
add rdx, rax
cmp qword [rdx + 0x18], 0xf
jbe 0x140019761
mov rdx, qword [rdx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004e10
lea rdx, [0x140004fe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0xf
cmova rax, qword [rsp + 0x188]
lea r9, [0x14003b1b0]
cmp qword [0x14003b1c8], 0xf
cmova r9, qword [0x14003b1b0]
lea r8, [rsp + 0x128]
cmp qword [rsp + 0x140], 0xf
cmova r8, qword [rsp + 0x128]
mov qword [rsp + 0x20], rax
lea rdx, str.C:WindowsSystem32cmd.exe_chcp_65001__C_C:Windowswget.exe__s__P__s__s
lea rcx, [rsp + 0x380]
call fcn.1400014c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x158], xmm1
lea rax, [rsp + 0x380]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140019803
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x148]
call fcn.140005420
lea rdx, [rsp + 0x148]
cmp qword [rsp + 0x160], 0xf
cmova rdx, qword [rsp + 0x148]
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdx, qword [rsp + 0x160]
cmp rdx, 0xf
jbe 0x1400198be
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400198b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400198b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
movsxd rdx, r15d
lea rax, str.Trang_thai_tai_dap_an_PE:
add rdx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], r13
inc rsi
cmp byte [rdx + rsi], 0
jne 0x1400198e0
mov r8, rsi
lea rcx, [rsp + 0x68]
call fcn.140005420
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xc8]
call fcn.14000f840
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0xf
jbe 0x14001994f
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019949
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019949
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
nop
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0xf
jbe 0x140019995
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019990
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019990
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
movdqa xmm0, xmmword [0x140032180]
movdqu xmmword [rsp + 0x198], xmm0
mov byte [rsp + 0x188], 0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0xf
jbe 0x1400199f4
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400199ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400199ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
mov qword [rsp + 0x138], r13
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], 0
lea rcx, [rsp + 0x2b0]
call fcn.1400079b0
lea rcx, [rsp + 0x290]
call fcn.140020b80
lea rcx, [rsp + 0x278]
call fcn.1400079b0
nop
lea rcx, [rsp + 0x230]
call fcn.140020b80
lea rcx, [rsp + 0x218]
call fcn.1400079b0
nop
jmp 0x140019a5d
mov rcx, r14
call qword [sym.imp.libcurl.dll_curl_easy_cleanup]
nop
mov rdx, qword [rsp + 0x200]
cmp rdx, 0xf
jbe 0x140019aad
inc rdx
mov rcx, qword [rsp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019aa8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019aa8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
movdqa xmm0, xmmword [0x140032180]
movdqu xmmword [rsp + 0x1f8], xmm0
mov byte [rsp + 0x1e8], 0
mov rdx, qword [rsp + 0x268]
cmp rdx, 0xf
jbe 0x140019b0d
inc rdx
mov rcx, qword [rsp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019b07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019b07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
nop
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 0xf
jbe 0x140019b53
inc rdx
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019b4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019b4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002606c
mov rcx, qword [rsp + 0x790]
xor rcx, rsp
call fcn.140025bc0
lea r11, [rsp + 0x7a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140001710
nop
call fcn.140001710
nop
call fcn.140004d10
int3