Function at 0x140005540
Capabilities:
Create http request
Create process on windows
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
mov eax, 0x11d0
call fcn.14000f040
sub rsp, rax
mov rax, qword [0x14004b070]
xor rax, rsp
mov qword [rsp + 0x11c8], rax
xor r15d, r15d
mov dword [rsp + 0x78], r15d
mov dword [rsp + 0x54], r15d
mov byte [rsp + 0x50], r15b
lea r13, [0x14004e000]
cmp dword [rsp + 0x54], 0xa
jge 0x140005b03
cmp byte [rsp + 0x50], 0
jne 0x140005b03
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.Download_Agent
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rdi, rax
test rax, rax
je 0x140005b35
lea r8, [0x14004df20]
lea rdx, [0x14004e040]
lea rcx, [rsp + 0x108]
call fcn.14000af80
nop
lea rdx, [rsp + 0x108]
cmp qword [rsp + 0x120], 0x10
cmovae rdx, qword [rsp + 0x108]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x140005b5e
mov rcx, r13
cmp qword [0x14004e018], 0x10
cmovae rcx, qword [0x14004e000]
lea rdx, [0x1400438d8]
call fcn.1400151a8
test rax, rax
je 0x140005672
mov rcx, rax
call fcn.1400156c8
mov rcx, r13
cmp qword [0x14004e018], 0x10
cmovae rcx, qword [0x14004e000]
call fcn.140015978
mov rcx, r13
cmp qword [0x14004e018], 0x10
cmovae rcx, qword [0x14004e000]
lea rdx, [0x140043b40]
call fcn.1400151a8
mov rsi, rax
mov rcx, rbx
test rax, rax
je 0x140005b8f
mov dword [rsp + 0x104], 0x20
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x104]
lea r8, [rsp + 0x1a0]
mov edx, 5
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x140005bc6
lea rcx, [rsp + 0x1a0]
call fcn.1400197d0
mov r12d, eax
mov r14d, r15d
lea r9, [rsp + 0x100]
mov r8d, 0x1000
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140005787
nop dword [rax]
mov ecx, dword [rsp + 0x100]
test ecx, ecx
je 0x140005787
mov edx, ecx
mov r9, rsi
mov r8d, 1
lea rcx, [rsp + 0x1c0]
call fcn.1400188b8
add r14d, dword [rsp + 0x100]
mov eax, r14d
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
xorps xmm0, xmm0
cvtsi2sd xmm0, r12
divsd xmm1, xmm0
mulsd xmm1, qword [0x140043ec0]
cvttsd2si eax, xmm1
mov dword [0x14004df0c], eax
lea r9, [rsp + 0x100]
mov r8d, 0x1000
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140005710
mov rcx, rsi
call fcn.1400156c8
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [0x14004e010]
movabs r14, 0x7fffffffffffffff
mov rax, r14
sub rax, rcx
cmp rax, 8
jb 0x140005c08
mov r9, r13
cmp qword [0x14004e018], 0x10
cmovae r9, qword [0x14004e000]
mov qword [rsp + 0x30], 8
lea rax, str.__SILENT
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x58]
call fcn.14000c8f0
or dword [rsp + 0x78], 1
mov rdx, qword [0x14004e018]
cmp rdx, 0x10
jb 0x14000583f
inc rdx
mov rcx, qword [0x14004e000]
cmp rdx, 0x1000
jb 0x14000583a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005c12
mov rcx, r8
call fcn.14000ea00
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [0x14004e000], xmm1
movups xmm2, xmmword [rsp + 0x68]
movups xmmword [0x14004e010], xmm2
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov rsi, r13
movq rcx, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rsi, rcx
movq rdi, xmm2
cmp rdi, r14
ja 0x140005c0d
mov qword [rsp + 0x70], 0xf
cmp rdi, 0x10
jae 0x1400058c1
mov qword [rsp + 0x68], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140010890
jmp 0x140005956
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
jbe 0x1400058d2
mov rbx, r14
jmp 0x1400058df
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140005929
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005c18
mov rcx, rax
call fcn.14000ea08
mov rcx, rax
test rax, rax
je 0x140005c1d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140005938
test rcx, rcx
je 0x140005935
call fcn.14000ea08
jmp 0x140005938
mov rax, r15
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140010890
lea rax, [rsp + 0x58]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x134], xmm0
movups xmmword [rsp + 0x144], xmm0
movups xmmword [rsp + 0x154], xmm0
movups xmmword [rsp + 0x164], xmm0
movups xmmword [rsp + 0x174], xmm0
movups xmmword [rsp + 0x184], xmm0
mov dword [rsp + 0x194], eax
mov dword [rsp + 0x130], 0x68
movups xmmword [rsp + 0xe8], xmm0
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0x68]
inc rcx
call fcn.14000ec94
mov rbx, rax
lea rcx, [rsp + 0x58]
mov r8, qword [rsp + 0x68]
cmp qword [rsp + 0x70], 0x10
jb 0x1400059e6
mov rdx, qword [rsp + 0x58]
add r8, rdx
jmp 0x1400059ee
add r8, rcx
lea rdx, [rsp + 0x58]
sub r8, rdx
mov rcx, rbx
call fcn.140010890
mov rax, qword [rsp + 0x68]
mov byte [rax + rbx], 0
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140005a9b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c23
call fcn.14000ea00
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x14004df08], 1
mov byte [rsp + 0x50], 1
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x140005af6
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005af0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c29
call fcn.14000ea00
nop
jmp 0x140005592
mov rcx, qword [rsp + 0x11c8]
xor rcx, rsp
call fcn.14000e9e0
lea r11, [rsp + 0x11d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rdx, str.Could_not_open_internet_connection.
lea rcx, [rsp + 0x88]
call fcn.140001550
lea rdx, [0x140049070]
lea rcx, [rsp + 0x88]
call fcn.1400107b4
nop
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, str.Could_not_open_internet_file.
lea rcx, [rsp + 0xa0]
call fcn.140001550
lea rdx, [0x140049070]
lea rcx, [rsp + 0xa0]
call fcn.1400107b4
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, str.Could_not_open_local_file.
lea rcx, [rsp + 0xb8]
call fcn.140001550
lea rdx, [0x140049070]
lea rcx, [rsp + 0xb8]
call fcn.1400107b4
mov rcx, rsi
call fcn.1400156c8
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, str.Could_not_query_file_size.
lea rcx, [rsp + 0xd0]
call fcn.140001550
lea rdx, [0x140049070]
lea rcx, [rsp + 0xd0]
call fcn.1400107b4
call fcn.140001530
call fcn.140001530
call fcn.14001a598
int3
call fcn.1400013c0
call fcn.14001a598
int3
call fcn.14001a598
nop
call fcn.14001a598
int3