Function at 0x1400070f0
Capabilities:
Contain obfuscated stackstrings
Create http request
Encode data using xor
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x1400b6060]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x30], rcx
xor r13d, r13d
mov dword [rsp + 0x30], 0x833074a
mov dword [rsp + 0x34], 0x393d2538
mov word [rsp + 0x38], 0x382f
mov byte [rsp + 0x3a], r13b
mov edi, r13d
nop dword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x31]
call fcn.140007930
movzx ebx, byte [rsp + 0x30]
xor bl, byte [rax]
mov rdx, rdi
lea rcx, [rsp + 0x31]
call fcn.140007930
mov byte [rax], bl
inc rdi
cmp rdi, 9
jb 0x140007150
mov byte [rsp + 0x3a], r13b
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, [rsp + 0x31]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r15, rax
test rax, rax
jne 0x14000733b
movdqa xmm0, xmmword [0x1400ad5f0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x63626b6e
mov word [rsp + 0x54], 0x273d
mov byte [rsp + 0x56], r13b
mov rcx, r13
nop dword [rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
inc rcx
cmp rcx, 0x15
jb 0x1400071d0
mov byte [rsp + 0x56], r13b
lea rdx, [rsp + 0x41]
lea rcx, [0x1400b79c0]
call fcn.14000d920
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.1400091e0
mov rcx, rax
call fcn.14000dbe0
mov al, 0x3c
mov dword [rsp + 0x30], 0x79003c
mov dword [rsp + 0x34], 0x4e004e
mov dword [rsp + 0x38], 0x4e0053
mov word [rsp + 0x3c], r13w
mov rcx, r13
nop word [rax + rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x32], ax
inc rcx
cmp rcx, 5
jae 0x140007258
movzx eax, byte [rsp + 0x30]
jmp 0x140007240
mov word [rsp + 0x3c], r13w
mov al, 0x7e
mov dword [rsp + 0x60], 0x38007e
mov dword [rsp + 0x64], 0x17001f
mov dword [rsp + 0x68], 0x1b0012
mov dword [rsp + 0x6c], 0x5e001a
mov dword [rsp + 0x70], 0x11000a
mov dword [rsp + 0x74], 0x17005e
mov dword [rsp + 0x78], 0x170010
mov dword [rsp + 0x7c], 0x17000a
mov dword [rbp - 0x80], 0x12001f
mov dword [rbp - 0x7c], 0x40017
mov dword [rbp - 0x78], 0x5e001b
mov dword [rbp - 0x74], 0x170029
mov dword [rbp - 0x70], 0x370010
mov dword [rbp - 0x6c], 0x1b0030
mov dword [rbp - 0x68], 0x5f000a
mov word [rbp - 0x64], r13w
mov rcx, r13
nop dword [rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x62], ax
inc rcx
cmp rcx, 0x1d
jae 0x1400072f8
movzx eax, byte [rsp + 0x60]
jmp 0x1400072e0
mov word [rbp - 0x64], r13w
xor r9d, r9d
lea r8, [rsp + 0x32]
lea rdx, [rsp + 0x62]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov qword [rsi], r13
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], r13
mov qword [rsi + 0x20], r13
xor r8d, r8d
lea rdx, [0x1400ac193]
mov rcx, rsi
call fcn.14000e400
jmp 0x1400076bc
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov r14, rax
test rax, rax
jne 0x1400074c0
movdqa xmm0, xmmword [0x1400acf70]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x9010640
mov dword [rsp + 0x54], 0x5a04050c
mov word [rsp + 0x58], 0x40
mov rcx, r13
nop
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
inc rcx
cmp rcx, 0x18
jb 0x140007390
mov byte [rsp + 0x59], r13b
lea rdx, [rsp + 0x41]
lea rcx, [0x1400b79c0]
call fcn.14000d920
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.1400091e0
mov rcx, rax
call fcn.14000dbe0
mov al, 0x53
mov dword [rsp + 0x40], 0x160053
mov dword [rsp + 0x44], 0x210021
mov dword [rsp + 0x48], 0x21003c
mov word [rsp + 0x4c], r13w
mov rcx, r13
nop word [rax + rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x42], ax
inc rcx
cmp rcx, 5
jae 0x140007418
movzx eax, byte [rsp + 0x40]
jmp 0x140007400
mov word [rsp + 0x4c], r13w
mov al, 0x3d
mov dword [rsp + 0x60], 0x7b003d
mov dword [rsp + 0x64], 0x54005c
mov dword [rsp + 0x68], 0x580051
mov dword [rsp + 0x6c], 0x1d0059
mov dword [rsp + 0x70], 0x520049
mov dword [rsp + 0x74], 0x52001d
mov dword [rsp + 0x78], 0x58004d
mov dword [rsp + 0x7c], 0x1d0053
mov dword [rbp - 0x80], 0x6f0068
mov dword [rbp - 0x7c], 0x1c0071
mov word [rbp - 0x78], r13w
mov rcx, r13
nop word [rax + rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x62], ax
inc rcx
cmp rcx, 0x13
jae 0x140007498
movzx eax, byte [rsp + 0x60]
jmp 0x140007480
mov word [rbp - 0x78], r13w
xor r9d, r9d
lea r8, [rsp + 0x42]
lea rdx, [rsp + 0x62]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x140007312
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
mov r12d, 0x10
mov ecx, r12d
call fcn.1400216e0
mov qword [rax + 8], r13
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x58]
mov qword [rax], rcx
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov dword [rbp - 0x30], r13d
lea r9, [rbp - 0x30]
mov r8d, 0x400
lea rdx, [rbp - 0x20]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000759d
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x14000759d
mov edi, eax
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x14000756a
lea rax, [rcx + rdi]
mov qword [rbp - 0x40], rax
lea rbx, [rbp - 0x50]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x50]
add rbx, rcx
mov r8d, edi
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.140025720
mov byte [rbx + rdi], 0
jmp 0x140007582
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x20]
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.14000e260
lea r9, [rbp - 0x30]
mov r8d, 0x400
lea rdx, [rbp - 0x20]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140007521
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov qword [rsi], r13
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], r13
mov qword [rsi + 0x20], r13
mov rcx, r12
call fcn.1400216e0
mov qword [rax + 8], r13
mov qword [rsi], rax
mov qword [rax], rsi
cmp qword [rbp - 0x38], 0x10
jb 0x1400075e9
lea rdx, [rbp - 0x58]
mov rcx, rsi
call fcn.140001be0
jmp 0x1400075f2
lea rcx, [rbp - 0x58]
call fcn.140001b70
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rsi + 8], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rsi + 0x18], xmm1
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
lea rcx, [rbp - 0x58]
call fcn.140001b70
mov rbx, qword [rbp - 0x38]
cmp rbx, 0x10
jb 0x14000769c
mov rdi, qword [rbp - 0x50]
inc rbx
test rdi, rdi
jne 0x140007691
test rbx, rbx
je 0x140007691
lea rax, str.null_pointer_cannot_point_to_a_block_of_non_zero_size
mov qword [rsp + 0x28], rax
lea rax, [0x1400ac014]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x33c
lea rdx, [0x1400ac020]
lea ecx, [rdi + 2]
call fcn.14002d680
cmp eax, 1
jne 0x14000766c
int3
mov qword [rsp + 0x20], r13
mov r9d, 0x33c
lea r8, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.34.31933includexmemory
lea rdx, [0x1400ac154]
lea rcx, str._null_pointer_cannot_point_to_a_block_of_non_zero_size_
call fcn.14002e560
mov rdx, rbx
mov rcx, rdi
call fcn.14000e800
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rcx, qword [rbp - 0x58]
mov qword [rbp - 0x58], r13
mov rdx, r12
call fcn.14000e800
mov rax, rsi
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.1400216a0
mov rbx, qword [rsp + 0x540]
add rsp, 0x4f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret