Function at 0x1400a880f
Capabilities:
Create process on windows
Delete file
Download url
Receive data

Disassembly:
jmp 0x1400c4320
push rbp
push rdi
sub rsp, 0x568
lea rbp, [rsp + 0x30]
lea rcx, [0x14027810e]
call fcn.1400a8774
nop
movzx eax, byte [0x140260100]
test eax, eax
jne 0x1400c434c
jmp 0x1400c4704
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x1a4]
call fcn.1400a791e
mov qword [rbp + 0x508], rax
movss xmm2, dword [0x1402600d4]
movss xmm1, dword [0x1402600d0]
lea rcx, [rbp + 0x1c4]
call fcn.1400a791e
mov qword [rbp + 0x510], rax
mov r8, qword [rbp + 0x508]
mov edx, 2
mov rcx, qword [rbp + 0x510]
call fcn.1400a7b80
nop
movss xmm2, dword [0x1402600e4]
movss xmm1, dword [0x1402600e0]
lea rcx, [rbp + 0x1e4]
call fcn.1400a791e
xor edx, edx
mov rcx, rax
call fcn.1400a6933
nop
movss xmm0, dword [0x1401feaec]
call fcn.1400a6064
nop
mov r8d, dword [0x14025a00c]
lea rdx, [0x140260100]
mov rcx, qword [section..data]
call fcn.1400a7e32
nop
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x224]
call fcn.1400a791e
mov qword [rbp + 0x508], rax
lea rax, [rbp + 0x284]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x2a8]
lea rcx, [rbp + 0x284]
call fcn.1400b14a0
mov rcx, rax
call fcn.1400a8b93
mov rdx, rax
lea rcx, [rbp + 0x248]
call fcn.1400a71ee
mov qword [rbp + 0x510], rax
mov rax, qword [rbp + 0x510]
mov qword [rbp + 0x518], rax
mov rcx, qword [rbp + 0x518]
call fcn.1400a637f
mov qword [rbp + 0x520], rax
mov rdx, qword [rbp + 0x508]
mov rcx, qword [rbp + 0x520]
call fcn.1400a6d4d
mov byte [rbp + 0x204], al
lea rcx, [rbp + 0x248]
call fcn.1400a6758
movzx eax, byte [rbp + 0x204]
test eax, eax
je 0x1400c4547
mov rcx, qword [str.standknife_claw.dll]
call qword [sym.imp.ucrtbased.dll_remove]
nop
mov rax, qword [str.standknife_claw.dll]
mov qword [rbp + 0x508], rax
lea rax, [rbp + 0x314]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x314]
call fcn.1400b16d0
mov rcx, rax
call fcn.1400a8bac
mov rdx, rax
lea rcx, [rbp + 0x2d8]
call fcn.1400a71ee
mov qword [rbp + 0x510], rax
mov rcx, qword [rbp + 0x510]
call fcn.1400a637f
mov qword [rbp + 0x518], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x10
mov r8, qword [rbp + 0x508]
mov rdx, qword [rbp + 0x518]
xor ecx, ecx
call fcn.1400a6898
lea rcx, [rbp + 0x2d8]
call fcn.1400a6758
nop
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x3a4]
call fcn.1400a791e
mov qword [rbp + 0x508], rax
lea rax, [rbp + 0x404]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x428]
lea rcx, [rbp + 0x404]
call fcn.1400b1910
mov rcx, rax
call fcn.1400a8b84
mov rdx, rax
lea rcx, [rbp + 0x3c8]
call fcn.1400a71ee
mov qword [rbp + 0x510], rax
mov rax, qword [rbp + 0x510]
mov qword [rbp + 0x518], rax
mov rcx, qword [rbp + 0x518]
call fcn.1400a637f
mov qword [rbp + 0x520], rax
mov rdx, qword [rbp + 0x508]
mov rcx, qword [rbp + 0x520]
call fcn.1400a6d4d
mov byte [rbp + 0x384], al
lea rcx, [rbp + 0x3c8]
call fcn.1400a6758
movzx eax, byte [rbp + 0x384]
test eax, eax
je 0x1400c4620
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [str.StandKnife.exe]
lea rdx, [0x1401fe9e0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x474]
call fcn.1400a791e
mov qword [rbp + 0x508], rax
lea rax, [rbp + 0x4d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x4f4]
lea rcx, [rbp + 0x4d4]
call fcn.1400b1960
mov rcx, rax
call fcn.1400a8b7f
mov rdx, rax
lea rcx, [rbp + 0x498]
call fcn.1400a71ee
mov qword [rbp + 0x510], rax
mov rax, qword [rbp + 0x510]
mov qword [rbp + 0x518], rax
mov rcx, qword [rbp + 0x518]
call fcn.1400a637f
mov qword [rbp + 0x520], rax
mov rdx, qword [rbp + 0x508]
mov rcx, qword [rbp + 0x520]
call fcn.1400a6d4d
mov byte [rbp + 0x454], al
lea rcx, [rbp + 0x498]
call fcn.1400a6758
movzx eax, byte [rbp + 0x454]
test eax, eax
je 0x1400c46fe
mov dword [rbp + 4], 0
mov dx, 0xd
mov rcx, qword [str.StandKnife.exe]
call fcn.1400a7afe
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1400c46fe
mov rdx, qword [str.standknife_claw.dll]
mov ecx, dword [rbp + 4]
call fcn.1400a7987
nop
call fcn.1400a7171
nop
lea rsp, [rbp + 0x538]
pop rdi
pop rbp
ret