Function at 0x14003a7d0
Capabilities:
Delete file
Download url
Get thread local storage value
Receive data
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11d0]
mov eax, 0x12d0
call fcn.140216080
sub rsp, rax
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rbp + 0x11c0], rax
lea rcx, [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, [rbp - 0x78]
mov qword [rbp - 0x80], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14003b075
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
lea rdx, [0x1402f09b0]
lea rcx, [rbp - 0x78]
cmp rdx, 0x10000
jae 0x14003a85d
movzx edx, dx
call fcn.14000d610
jmp 0x14003a863
call fcn.140035160
nop
xor r15d, r15d
mov dword [rbp - 0x70], r15d
xorps xmm0, xmm0
movsd qword [rbp - 0x68], xmm0
mov dword [rbp - 0x60], r15d
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x68]
call fcn.140036080
mov ecx, r15d
test eax, eax
sete cl
mov dword [rbp - 0x60], ecx
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14003b080
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x78]
call fcn.1400482f0
mov dil, 1
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14003b08b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x78]
lea rdx, str.Last_Ad_XML_Download_Time
lea rcx, str.Helper
call fcn.140047fa0
test eax, eax
je 0x14003a937
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x14003b096
mov rcx, qword [rsp + 0x58]
sub rax, rcx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x14003a928
add rcx, 2
test dx, dx
jne 0x14003a911
mov eax, r15d
jmp 0x14003a92d
sbb eax, eax
or eax, 1
movzx edi, dil
test eax, eax
cmove edi, r15d
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14003b0a1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14002fc10
mov r13, qword [rsp + 0x70]
lea rcx, [r13 - 0x18]
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rdx, [0x1402ed690]
mov rsi, 0xffffffffffffffff
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003a990
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.1400157c0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14003a9c3
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14003a9de
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x14003b06a
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, str.HelperConfig.xml
lea rcx, [rsp + 0x60]
cmp rdx, 0x10000
jae 0x14003aa0c
movzx edx, dx
call fcn.14000d610
jmp 0x14003aa12
call fcn.140035160
nop
mov rdx, qword [rsp + 0x60]
lea rbx, [rdx - 0x18]
mov r8d, dword [rbx + 8]
lea rcx, [rsp + 0x50]
call fcn.1400157c0
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14003aa42
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x50]
add rcx, 0xffffffffffffffe8
call fcn.14000de80
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rcx, [rbp - 0x80]
call fcn.140032ea0
test eax, eax
je 0x14003aa94
test dil, dil
jne 0x14003aa94
mov rbx, qword [0x14034dd10]
test rbx, rbx
jne 0x14003af9c
lea rcx, [rsp + 0x50]
call fcn.14003a4d0
test al, al
je 0x14003aa94
mov rbx, qword [0x14034dd10]
jmp 0x14003af9c
xor ecx, ecx
call fcn.14024b6a0
mov rcx, qword [0x14034e848]
add rcx, 0x3c
cmp rcx, rax
jle 0x14003aab3
mov rbx, r15
jmp 0x14003af9c
mov qword [0x14034e848], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14003b06a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdx, str.https:__www.revouninstaller.com_rufhxml.cab
cmp rdx, 0x10000
jae 0x14003aaf9
movzx edx, dx
lea rcx, [rsp + 0x68]
call fcn.14000d610
jmp 0x14003ab18
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14003ab00
mov r8d, eax
lea rcx, [rsp + 0x68]
call fcn.14000df90
nop
lea rcx, [rbp - 0x28]
call fcn.14003a3f0
nop
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea r8, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r8, qword [rbp - 0x28]
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea r12, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r12, qword [rbp - 0x28]
mov qword [rbp - 0x30], r12
test eax, eax
jns 0x14003ab6f
mov rbx, r15
jmp 0x14003af26
lea rcx, [rbp + 0x10]
call fcn.140037620
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbp + 0x1188], eax
je 0x14003ab9e
mov qword [rbp + 0x1150], 0x3f3
mov dword [rbp + 0x1158], r15d
jmp 0x14003ae01
mov ecx, dword [0x14034dcd8]
cmp ecx, 0xffffffff
je 0x14003adea
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003abcf
mov qword [rbp + 0x1150], 0x3f4
mov dword [rbp + 0x1158], r15d
jmp 0x14003ae01
mov ecx, dword [0x14034dcd8]
cmp ecx, 0xffffffff
je 0x14003adea
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14003adea
mov ecx, dword [0x14034dcd8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003adea
mov qword [rbp + 0x1150], r15
mov dword [rbp + 0x1158], r15d
xor eax, eax
mov qword [rbp + 0x1130], rax
mov dword [rbp + 0x1138], eax
cmp qword [rbp + 0x1160], rax
jne 0x14003ae01
mov rax, qword [sym.imp.Cabinet.dll_FDICreate]
mov qword [rbp + 0x1198], rax
mov rax, qword [sym.imp.Cabinet.dll_FDICopy]
mov qword [rbp + 0x11a0], rax
mov rax, qword [sym.imp.Cabinet.dll_FDIIsCabinet]
mov qword [rbp + 0x11a8], rax
mov rax, qword [sym.imp.Cabinet.dll_FDIDestroy]
mov qword [rbp + 0x11b0], rax
lea rax, [rbp + 0x1130]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 1
lea rax, [0x140038390]
mov qword [rsp + 0x30], rax
lea rax, [0x140038350]
mov qword [rsp + 0x28], rax
lea rax, [0x140038200]
mov qword [rsp + 0x20], rax
lea r9, [0x1400381b0]
lea r8, [0x1400380b0]
lea rdx, [fcn.1400081a0]
lea rcx, [0x1400380a0]
call qword [sym.imp.Cabinet.dll_FDICreate]
mov qword [rbp + 0x1160], rax
test rax, rax
je 0x14003ae01
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rbp - 0x58], r15
mov dword [rbp - 0x50], r15d
mov rbx, qword [rsp + 0x70]
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14003acf0
mov r14d, 0x12c
cmp eax, r14d
cmovb eax, r14d
mov edx, eax
lea rcx, [rbp - 0x58]
call fcn.140036d40
mov r15, qword [rbp - 0x58]
mov rcx, r15
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
mov word [rbx + rcx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x14003ad20
lea rbx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rbx, qword [rbp - 0x28]
xor eax, eax
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x40], eax
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14003ad50
cmp eax, r14d
cmovb eax, r14d
mov edx, eax
lea rcx, [rbp - 0x48]
call fcn.140036d40
mov r14, qword [rbp - 0x48]
mov rdx, r14
sub rdx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rbx + rdx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x14003ad80
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x10]
call fcn.140037970
mov ebx, eax
mov rcx, r14
call fcn.140095d64
nop
mov rcx, r15
call fcn.140095d64
test ebx, ebx
je 0x14003adfe
lea rcx, [rsp + 0x50]
call fcn.14003a4d0
test al, al
je 0x14003adfe
mov r8, qword [rsp + 0x58]
lea rdx, str.Last_Ad_XML_Download_Time
lea rcx, str.Helper
call fcn.140047c80
mov rbx, qword [0x14034dd10]
xor r15d, r15d
jmp 0x14003ae04
mov dword [rbp + 0x1150], r15d
mov qword [rbp + 0x1154], FDICreate
jmp 0x14003ae01
xor r15d, r15d
mov rbx, r15
lea rax, vtable.Cabinet::CExtract.0
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbp + 0x1188], eax
je 0x14003ae31
mov qword [rbp + 0x1150], 0x3f3
mov dword [rbp + 0x1158], r15d
jmp 0x14003ae8d
mov rcx, qword [rbp + 0x1160]
test rcx, rcx
je 0x14003ae6a
call qword [rbp + 0x11b0]
mov r14d, eax
mov qword [rbp + 0x1160], r15
mov rcx, qword [rbp + 0x1120]
test rcx, rcx
je 0x14003ae5e
call fcn.140095d64
mov qword [rbp + 0x1120], r15
test r14d, r14d
je 0x14003ae8d
mov ecx, dword [0x14034dcd8]
cmp ecx, 0xffffffff
je 0x14003ae8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14003ae8d
mov ecx, dword [0x14034dcd8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rbp + 0x1190]
test rcx, rcx
je 0x14003ae9f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp + 0x1170]
test rcx, rcx
je 0x14003aeb5
mov edx, 1
call fcn.1400081a0
mov rcx, qword [rbp + 0x1140]
call fcn.140095d64
mov rcx, qword [rbp + 0x1120]
test rcx, rcx
je 0x14003aed2
call fcn.140095d64
mov qword [rbp + 0x1120], r15
mov rcx, qword [rbp + 0xb8]
call fcn.140095d64
mov rcx, qword [rbp + 0xa8]
call fcn.140095d64
mov edx, 8
mov rcx, qword [rbp + 0x98]
call fcn.1400081a0
mov edx, 4
mov rcx, qword [rbp + 0xa0]
call fcn.1400081a0
mov rcx, qword [rbp + 0x30]
call fcn.140095d64
mov rcx, qword [rbp + 0x20]
call fcn.140095d64
nop
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14003af70
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003af6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b064
call fcn.1400081a0
movdqa xmm0, xmmword [0x1402fa1a0]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r15w
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003af9c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003afbb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, esi
lock xadd dword [r13 - 8], eax
sub eax, 1
jg 0x14003afd7
mov rcx, qword [r13 - 0x18]
mov rax, qword [rcx]
lea rdx, [r13 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003aff6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003b015
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14003b031
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rbx
mov rcx, qword [rbp + 0x11c0]
xor rcx, rsp
call fcn.1402155d0
lea r11, [rsp + 0x12d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14024b534
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
int3