Function at 0x140011479
Capabilities:
Create directory
Create process on windows

Disassembly:
jmp 0x14001b8a0
push rbp
push rdi
sub rsp, 0xb08
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x1ee
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14003e040]
xor rax, rbp
mov qword [rbp + 0xaa8], rax
lea rcx, [0x1400460fd]
call fcn.140011c08
call fcn.140011690
movzx eax, al
test eax, eax
jne 0x14001b90a
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.This_option_requires_administrative_privileges._Please_start_the_.exe_as_Admin.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14001baff
mov r8d, 0x104
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x240]
call fcn.140011398
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [0x140036f28]
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rax, str.https:__www.techpowerup.com_download_visual_c_redistributable_runtime_package_all_in_one_
mov qword [rbp + 0x468], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x468]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r9d, 0x40
lea r8, str.Download_Instructions
lea rdx, str.Please_download_the_file_manually_and_extract_it_into_the_CPP_folder.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r9d, 0x24
lea r8, str.Extraction_Confirmation
lea rdx, str.Have_you_extracted_the_.rar_file_into_the_CPP_folder__nClick_Yes_to_proceed_with_the_installation.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 6
jne 0x14001baff
lea rax, str.install_all.bat
mov qword [rbp + 0x4a8], rax
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x4d0]
call fcn.140011398
mov rdx, qword [rbp + 0x4a8]
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x700]
call fcn.14001193d
mov dword [rbp + 0x700], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x788]
call fcn.14001193d
lea rax, [rbp + 0x788]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x700]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x4d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001bae3
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x788]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x788]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x790]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x40
lea r8, str.Execution_Completed
lea rdx, str.Script_execution_completed.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14001baff
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_execute_the_script._Please_contact_support.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rbp - 0x50]
lea rdx, [0x140030c80]
call fcn.140011a1e
mov rcx, qword [rbp + 0xaa8]
xor rcx, rbp
call fcn.1400115f5
lea rsp, [rbp + 0xab8]
pop rdi
pop rbp
ret