Function at 0x140011325
Capabilities:
Create thread
Download url
Enumerate processes
Inject dll
Inject thread
Receive data

Disassembly:
jmp 0x14001a530
mov qword [rsp + 8], rcx
push r13
push rbp
push rdi
sub rsp, 0x9b0
lea r13, [rsp + 0x40]
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
lea rdi, [rsp + 0x40]
mov ecx, 0x19c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x9d8]
mov rax, qword [0x140034018]
xor rax, r13
mov qword [rbp + 0x948], rax
lea rcx, [0x14003b105]
call fcn.14001189d
mov dword [rbp + 4], 0
mov dword [rbp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call fcn.140011406
mov qword [rbp + 0x288], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x288]
call fcn.140011569
test eax, eax
je 0x14001a698
lea rax, [rbp + 0x6c4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x6e4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x6c4]
movzx r8d, byte [rbp + 0x6e4]
movzx edx, byte [rbp + 0x704]
lea rcx, [rbp + 0x690]
call fcn.1400149f0
mov rcx, rax
call fcn.140011988
mov qword [rbp + 0x928], rax
lea rdx, [rbp + 0x5c]
lea rcx, [rbp + 0x728]
call fcn.1400112a8
mov qword [rbp + 0x930], rax
mov rax, qword [rbp + 0x930]
mov qword [rbp + 0x938], rax
mov rax, qword [rbp + 0x938]
mov qword [rbp + 0x940], rax
mov rdx, qword [rbp + 0x928]
mov rcx, qword [rbp + 0x940]
call fcn.1400112cb
mov byte [rbp + 0x664], al
lea rcx, [rbp + 0x728]
call fcn.14001178f
movzx eax, byte [rbp + 0x664]
test eax, eax
je 0x14001a680
mov eax, dword [rbp + 0x38]
mov dword [rbp + 4], eax
jmp 0x14001a698
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x288]
call fcn.140011794
test eax, eax
jne 0x14001a5bd
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 4], 0
jne 0x14001a6de
lea rdx, str.Nie_znaleziono_Minecrafta
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110ff
mov qword [rbp + 0x928], rax
lea rdx, [0x14001105f]
mov rcx, qword [rbp + 0x928]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001a955
lea rax, [rbp + 0x834]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x854]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x834]
movzx r8d, byte [rbp + 0x854]
movzx edx, byte [rbp + 0x874]
lea rcx, [rbp + 0x780]
call fcn.140014b50
mov rcx, rax
call fcn.14001197e
mov rdx, rax
lea rcx, [rbp + 0x2a8]
call fcn.1400112a8
nop
lea rcx, [rbp + 0x2a8]
call fcn.1400112bc
mov qword [rbp + 0x928], rax
mov rcx, qword [r13 + 0x990]
call fcn.1400112bc
mov qword [rbp + 0x930], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x928]
mov rdx, qword [rbp + 0x930]
xor ecx, ecx
call fcn.1400117ee
mov dword [rbp + 0x2e4], eax
cmp dword [rbp + 0x2e4], 0
je 0x14001a83f
mov rax, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov qword [rbp + 0x928], rax
lea rax, [rbp + 0x8d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x8f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x8d4]
movzx r8d, byte [rbp + 0x8f4]
movzx edx, byte [rbp + 0x914]
lea rcx, [rbp + 0x8a0]
call fcn.140014ff0
mov rcx, rax
call fcn.140011983
mov qword [rbp + 0x930], rax
mov rdx, qword [rbp + 0x930]
mov rcx, qword [rbp + 0x928]
call fcn.1400110ff
mov qword [rbp + 0x938], rax
lea rdx, [0x14001105f]
mov rcx, qword [rbp + 0x938]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x2a8]
call fcn.14001178f
jmp 0x14001a955
mov r8d, dword [rbp + 4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x308], rax
lea rcx, [rbp + 0x2a8]
call fcn.1400112ad
shl rax, 1
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x328], rax
lea rcx, [rbp + 0x2a8]
call fcn.1400112ad
shl rax, 1
mov qword [rbp + 0x928], rax
lea rcx, [rbp + 0x2a8]
call fcn.1400112bc
mov qword [rbp + 0x930], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x928]
mov r8, qword [rbp + 0x930]
mov rdx, qword [rbp + 0x328]
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.LoadLibraryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x348], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x328]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x348]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x2a8]
call fcn.14001178f
lea rcx, [rbp - 0x40]
lea rdx, [0x14002e4d0]
call fcn.140011721
mov rcx, qword [rbp + 0x948]
xor rcx, r13
call fcn.140011424
lea rsp, [r13 + 0x970]
pop rdi
pop rbp
pop r13
ret