Function at 0x140001290
Capabilities:
Execute command
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rax
mov ebx, 0xf
mov qword [rbp + 0x27], rbx
mov byte [rbp + 0xf], al
lea rdx, str.Hangi_Programi_Acmak_istiyorsun_Roblox_Craftrise_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001b40
lea rdx, [rbp + 0xf]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140001d10
lea rcx, [rbp + 0xf]
mov rsi, qword [rbp + 0xf]
mov r15, qword [rbp + 0x27]
cmp r15, rbx
cmova rcx, rsi
mov rdi, qword [rbp + 0x1f]
cmp rdi, 6
jne 0x14000132e
mov r8, rdi
lea rdx, str.Roblox
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000135b
lea rcx, [rbp + 0xf]
cmp r15, 0xf
cmova rcx, rsi
cmp rdi, 6
jne 0x14000159b
mov r8, rdi
lea rdx, str.roblox
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000159b
lea rdx, str.Roblox_Y
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001b40
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.start_https:__cdn.discordapp.com_attachments_1126040124283699312_1181694106305564673_RobloxPlayerInstaller.exe_ex6581fd65is656f8865hm4c8b9055a2c097535a286ac0fff2bb6d6d68e74719045f9270345ec5abbf797e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp - 0x39], 7
lea rcx, [rbp - 0x39]
call fcn.140001f30
lea rcx, str.USERPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.140001910
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r12, qword [rbp - 1]
sub rax, r12
cmp rax, 0x24
jb 0x14000189e
lea rdx, [rbp - 0x11]
mov r14, qword [rbp - 0x11]
mov r13, qword [rbp + 7]
cmp r13, 0xf
cmova rdx, r14
mov qword [rbp - 0x39], rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
add r12, 0x24
lea rdi, [rbp - 0x31]
cmp r12, 0xf
jbe 0x14000148e
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000144d
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002410
test rax, rax
je 0x140001540
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rdx, qword [rbp - 0x39]
jmp 0x14000148a
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001475
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001892
jmp 0x14000142a
test rcx, rcx
je 0x140001488
call fcn.140002410
mov rdi, rax
mov rdx, qword [rbp - 0x39]
jmp 0x14000148a
xor edi, edi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], rbx
mov rbx, qword [rbp - 1]
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.DownloadsRobloxPlayerInstaller.exe]
movups xmmword [rbx + rdi], xmm0
movups xmm1, xmmword [0x1400045b0]
movups xmmword [rbx + rdi + 0x10], xmm1
mov eax, dword [0x1400045c0]
mov dword [rbx + rdi + 0x20], eax
mov byte [rdi + r12], 0
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova rcx, qword [rbp - 0x31]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp - 0x39], 0x28
lea rcx, [rbp - 0x39]
call fcn.140001f30
lea rcx, str.start_____C:Program_FilesRobloxRobloxPlayer.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp - 0x39], 5
lea rcx, [rbp - 0x39]
call fcn.140001f30
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x14000154c
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001547
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001547
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000244c
movdqa xmm0, xmmword [0x1400046e0]
movdqu xmmword [rbp - 0x21], xmm0
mov byte [rbp - 0x31], 0
cmp r13, 0xf
jbe 0x140001823
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400017f5
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rbp + 0xf]
cmp r15, 0xf
cmova rcx, rsi
cmp rdi, 9
jne 0x1400015c0
mov r8, rdi
lea rdx, str.Craftrise
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400015ed
lea rcx, [rbp + 0xf]
cmp r15, 0xf
cmova rcx, rsi
cmp rdi, 9
jne 0x1400017ff
mov r8, rdi
lea rdx, str.craftrise
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400017ff
lea rdx, str.Craftrise_Yukleniyor_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001b40
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.start_https:__www.craftrise.com.tr_launcher_CraftRise.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp - 0x39], 3
lea rcx, [rbp - 0x39]
call fcn.140001f30
lea rcx, str.USERPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.140001910
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rdx, qword [rbp - 1]
sub rax, rdx
cmp rax, 0x18
jb 0x14000188c
lea r9, [rbp - 0x11]
mov r14, qword [rbp - 0x11]
mov r13, qword [rbp + 7]
cmp r13, 0xf
cmova r9, r14
mov qword [rbp - 0x39], r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
lea r12, [rdx + 0x18]
lea rdi, [rbp - 0x31]
cmp r12, 0xf
jbe 0x140001728
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400016e3
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002410
test rax, rax
je 0x1400017a6
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rdx, qword [rbp - 1]
mov r9, qword [rbp - 0x39]
jmp 0x140001724
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000170b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001898
jmp 0x1400016bc
test rcx, rcx
je 0x140001722
call fcn.140002410
mov rdi, rax
mov rdx, qword [rbp - 1]
mov r9, qword [rbp - 0x39]
jmp 0x140001724
xor edi, edi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], rbx
mov r8, rdx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.DownloadsCraftrise.exe]
mov rax, qword [rbp - 1]
movups xmmword [rax + rdi], xmm0
movsd xmm0, qword [0x140004688]
movsd qword [rax + rdi + 0x10], xmm0
mov byte [rdi + r12], 0
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova rcx, qword [rbp - 0x31]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x1400017b2
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000244c
movdqa xmm0, xmmword [0x1400046e0]
movdqu xmmword [rbp - 0x21], xmm0
mov byte [rbp - 0x31], 0
cmp r13, 0xf
jbe 0x140001823
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400017f5
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14000244c
jmp 0x140001823
lea rdx, [0x140004698]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001b40
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
cmp r15, 0xf
jbe 0x14000185d
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001855
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001855
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14000244c
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400023f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.1400011b0
int3