Function at 0x140014d48
Capabilities:
Create process on windows

Disassembly:
jmp 0x1400335c0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x498
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xba
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4b8]
mov rax, qword [0x14004f040]
xor rax, rbp
mov qword [rbp + 0x450], rax
lea rcx, [0x14005a18f]
call fcn.140015275
mov edx, 0x60
lea rcx, [rbp + 0x10]
call fcn.14001516c
lea rdx, str.C:Users_adminDownloads_stalker.png
lea rcx, [rbp + 0x268]
call fcn.140014870
mov r8d, 1
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x10]
call fcn.1400152d9
lea rcx, [rbp + 0x268]
call fcn.140014361
lea rcx, [rbp + 0x10]
call fcn.140014550
movzx eax, al
test eax, eax
je 0x1400336b7
lea rdx, [0x140042d70]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001421c
mov qword [rbp + 0x448], rax
lea rdx, [0x1400140be]
mov rcx, qword [rbp + 0x448]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x2a4], 1
lea rcx, [rbp + 0x10]
call fcn.140015176
mov eax, dword [rbp + 0x2a4]
jmp 0x140033884
mov r8d, 0x1db
mov edx, 0x3d4
lea rcx, [rbp + 0x88]
call fcn.1400145d7
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x328], rax
mov rax, qword [rbp + 0x328]
mov qword [rbp + 0x348], rax
mov rax, qword [rbp + 0x348]
mov qword [rbp + 0x368], rax
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x2c8]
call fcn.1400145aa
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x2f8]
call fcn.1400147fd
mov dword [rsp + 0x28], 1
xorps xmm0, xmm0
movsd qword [rsp + 0x20], xmm0
xorps xmm3, xmm3
mov r8, qword [rbp + 0x368]
lea rdx, [rbp + 0x2c8]
lea rcx, [rbp + 0x2f8]
call fcn.140015063
lea rcx, [rbp + 0x2f8]
call fcn.14001505e
lea rcx, [rbp + 0x2c8]
call fcn.140015428
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x388]
call fcn.1400147fd
lea rdx, str.Image
lea rcx, [rbp + 0x3b8]
call fcn.140014870
lea rdx, [rbp + 0x388]
lea rcx, [rbp + 0x3b8]
call fcn.140014bef
lea rcx, [rbp + 0x3b8]
call fcn.140014361
lea rcx, [rbp + 0x388]
call fcn.14001505e
lea rdx, str.Image
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rbp + 0xa8], rax
xor eax, eax
cmp eax, 1
je 0x14003386b
mov r9d, 4
lea r8, str.Bye__
lea rdx, str.Hi__do_you_allow_access_to_your_files_
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 6
jne 0x140033835
call fcn.140014041
call fcn.1400145a5
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__itorrents_igruha.org
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14003386b
call fcn.140014041
call fcn.140014d66
jmp 0x14003386b
mov dword [rbp + 0x434], 0
lea rcx, [rbp + 0x10]
call fcn.140015176
mov eax, dword [rbp + 0x434]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140042d60]
call fcn.140014f23
mov rax, rdi
mov rcx, qword [rbp + 0x450]
xor rcx, rbp
call fcn.140014901
lea rsp, [rbp + 0x468]
pop rdi
pop rbp
ret