Function at 0x14001855a
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
jmp 0x140027420
push r13
push rbp
push rdi
sub rsp, 0x720
lea r13, [rsp + 0x50]
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
lea rdi, [rsp + 0x50]
mov ecx, 0x124
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140059040]
xor rax, r13
mov qword [rbp + 0x6a0], rax
lea rcx, [0x140061168]
call fcn.140018f1e
nop
lea rax, [rbp + 0x474]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x494]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x474]
movzx r8d, byte [rbp + 0x494]
movzx edx, byte [rbp + 0x4b4]
lea rcx, [rbp + 0x400]
call fcn.14001a740
mov rcx, rax
call fcn.140018d7a
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.1400186db
nop
lea rax, [rbp + 0x514]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x534]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x514]
movzx r8d, byte [rbp + 0x534]
movzx edx, byte [rbp + 0x554]
lea rcx, [rbp + 0x4e0]
call fcn.14001b150
mov rcx, rax
call fcn.140018abe
mov qword [rbp + 0x668], rax
lea rcx, [rbp + 0x578]
call fcn.140018ded
mov qword [rbp + 0x670], rax
mov rax, qword [rbp + 0x670]
mov qword [rbp + 0x678], rax
mov rax, qword [rbp + 0x678]
mov qword [rbp + 0x680], rax
lea rdx, [rbp + 0x5b8]
mov rcx, qword [rbp + 0x680]
call fcn.14001825d
mov qword [rbp + 0x688], rax
mov rax, qword [rbp + 0x688]
mov qword [rbp + 0x690], rax
mov rax, qword [rbp + 0x690]
mov qword [rbp + 0x698], rax
mov r8, qword [rbp + 0x668]
mov rdx, qword [rbp + 0x698]
lea rcx, [rbp + 0x48]
call fcn.140018dde
nop
lea rcx, [rbp + 0x5b8]
call fcn.1400182b2
nop
lea rcx, [rbp + 0x578]
call fcn.140018dd9
nop
lea rcx, [rbp + 0x48]
call fcn.14001816d
mov qword [rbp + 0x668], rax
lea rcx, [rbp + 8]
call fcn.14001816d
mov qword [rbp + 0x670], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x668]
mov rdx, qword [rbp + 0x670]
xor ecx, ecx
call fcn.140018343
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jl 0x140027752
lea r8, [rbp + 0x48]
lea rdx, [0x140050654]
lea rcx, [rbp + 0x5f8]
call fcn.140018096
mov qword [rbp + 0x668], rax
mov rax, qword [rbp + 0x668]
mov qword [rbp + 0x670], rax
lea r8, str.___quiet_InstallAllUsers1_PrependPath1
mov rdx, qword [rbp + 0x670]
lea rcx, [rbp + 0xa8]
call fcn.140018dde
nop
lea rcx, [rbp + 0x5f8]
call fcn.1400182b2
nop
mov dword [rbp + 0xf0], 0x68
lea rax, [rbp + 0xf8]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov dword [rbp + 0x12c], 1
xor eax, eax
mov word [rbp + 0x130], ax
lea rcx, [rbp + 0xa8]
call fcn.14001816d
lea rcx, [rbp + 0x178]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140027745
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x638]
call fcn.140018bef
nop
lea rcx, [rbp + 0x638]
call fcn.140018c94
nop
lea rcx, [rbp + 0x638]
call fcn.140018dd9
nop
lea rcx, [rbp + 0xa8]
call fcn.1400182b2
nop
lea rcx, [rbp + 0x48]
call fcn.1400182b2
nop
lea rcx, [rbp + 8]
call fcn.1400182b2
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x14004e330]
call fcn.140018c76
mov rcx, qword [rbp + 0x6a0]
xor rcx, r13
call fcn.140018758
lea rsp, [r13 + 0x6d0]
pop rdi
pop rbp
pop r13
ret