Function at 0x140056250
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete file
Download url
Get file attributes
Receive data
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14006e040]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov rdi, rcx
xor r12d, r12d
movabs rax, 0xdd2b2802abce9746
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x40], rax
movabs rax, 0xdd02918d64640ef
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x48], rax
movabs rax, 0x9c7416fabefd0371
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x50], rax
movabs rax, 0x99fe2bd4d4554b91
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x58], rax
movabs r13, 0x1ef6fe999113ae89
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x60], rax
movabs rcx, 0x44c5c0e03f356ac2
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x68], rax
movabs rsi, 0xa958476dc992ad05
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x200], rax
movabs r14, 0x6cba7574ba332e8e
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x208], rax
movabs rax, 0xf6287893dca16207
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x210], rax
movabs rax, 0xf5924ffaa3343df0
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x218], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x220], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x228], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqa xmm0, xmmword [rbp + 0x60]
vxorps xmm0, xmm0, xmmword [rbp + 0x220]
vmovdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x40]
vzeroupper
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rdi]
mov rcx, qword [rcx]
call fcn.140011000
mov rcx, qword [0x14009f1f0]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, dword [0x140064714]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x140064724]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
lea rcx, str.Starting
call fcn.140039d30
call fcn.1400110a0
mov rax, qword [rdi + 8]
mov rbx, qword [rax]
movaps xmm0, xmmword [0x1400648b0]
movups xmmword [rbp + 0xf0], xmm0
lea rcx, [rbp + 0xf0]
call fcn.1400032c0
mov rcx, qword [rdi + 0x10]
movss xmm2, dword [rcx + 4]
addss xmm2, dword [0x140064724]
movss xmm1, dword [rcx]
movaps xmm0, xmm1
addss xmm0, dword [0x140064708]
addss xmm0, dword [0x140064748]
movss dword [rbp + 0x14], xmm0
movss dword [rbp + 0x18], xmm2
addss xmm1, dword [0x140064704]
movss dword [rbp], xmm1
movss dword [rbp + 4], xmm2
mov dword [rsp + 0x28], r12d
movss xmm0, dword [0x140064690]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rbp + 0x14]
lea rdx, [rbp]
mov rcx, rbx
call fcn.14002eff0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0xc4392906aafbc323
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
movabs rax, 0x6cba7574ba3313eb
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x240], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x248], rax
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x80], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
lea r8d, [r12 + 0x3a]
lea rdx, str.https:__dolphin.rent_boostanull_connect.php_actionget_ram
lea rcx, [rbp + 0xb0]
call fcn.1400580c0
nop
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xb0]
call fcn.140056f90
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
lea rdx, [0x14009f200]
lea rcx, [rbp + 0x90]
call fcn.140056f90
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x14005665a
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056655
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056655
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058f44
movdqa xmm0, xmmword [0x1400647f0]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x1400566b5
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400566b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400566b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058f44
movdqa xmm0, xmmword [0x1400647f0]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
lea r15, [rbp + 0x1a0]
movq rdi, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 0xf
cmova r15, rdi
movabs rbx, 0x7fffffffffffffff
movq rsi, xmm6
cmp rsi, rbx
ja 0x140056e7a
cmp rsi, 0xf
ja 0x140056734
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], 0xf
movups xmm0, xmmword [r15]
movups xmmword [rbp + 0x20], xmm0
jmp 0x1400567c5
mov rax, rsi
or rax, 0xf
cmp rax, rbx
jbe 0x140056770
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140059138
mov rcx, rax
test rax, rax
je 0x140056894
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400567aa
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005679b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056e80
jmp 0x14005674e
test rcx, rcx
je 0x1400567a7
call fcn.140059138
jmp 0x1400567aa
mov rax, r12
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rbx
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xd0]
call fcn.14004e510
mov rbx, rax
lea rsi, [0x14009e950]
cmp rsi, rax
je 0x14005685c
mov rdx, qword [0x14009e968]
cmp rdx, 0xf
jbe 0x140056821
mov rcx, qword [0x14009e950]
inc rdx
cmp rdx, 0x1000
jb 0x14005681c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140056894
mov rcx, r8
call fcn.140058f44
movdqa xmm0, xmmword [0x1400647f0]
movdqu xmmword [0x14009e960], xmm0
mov byte [0x14009e950], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x14009e950], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x14009e960], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x1400568a0
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005689b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005689b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058f44
movdqa xmm0, xmmword [0x1400647f0]
movdqu xmmword [rbp + 0xe0], xmm0
mov byte [rbp + 0xd0], 0
lea rcx, str.C:_boostanulljava
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400568d4
shr eax, 4
test al, 1
jne 0x1400569cc
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:_boostanulljava.zip
lea rdx, str.https:__api.danaloader.ru_boostanull_java.zip
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x1400569cc
mov dword [rbp + 0x120], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
lea rax, [rbp + 0x130]
test rax, rax
je 0x140056975
lea rdx, str.C:_boostanulljava.zip
lea rcx, [rbp + 0x130]
call fcn.14004c7b0
test eax, eax
je 0x140056975
lea r9, [rbp + 0x120]
lea rdx, str.C:_boostanull
lea rcx, [rbp + 0x130]
call fcn.14004d450
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:_boostanulljava.zip
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
cmp r14, 0xf
jbe 0x140056aec
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140056ae4
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056ae4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, str.C:_boostanullclient_1_16_5
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400569e9
shr eax, 4
test al, 1
jne 0x140056af3
xor edx, edx
lea rcx, str.C:_boostanullclient_1_16_5
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:_boostanullClient.zip
lea rdx, str.https:__api.danaloader.ru_boostanull_Client.zip
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x140056af3
mov dword [rbp + 0x120], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
lea rax, [rbp + 0x130]
test rax, rax
je 0x140056a99
lea rdx, str.C:_boostanullClient.zip
lea rcx, [rbp + 0x130]
call fcn.14004c7b0
test eax, eax
je 0x140056a99
lea r9, [rbp + 0x120]
lea rdx, str.C:_boostanullclient_1_16_5
lea rcx, [rbp + 0x130]
call fcn.14004d450
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:_boostanullClient.zip
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
cmp r14, 0xf
jbe 0x140056aec
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140056ae4
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056ae4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140058f44
mov al, 1
jmp 0x140056e40
mov ecx, 0x4e2
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0xdd2b2802abce9746
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xdd02918d64640ef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x9c7416fabefd0371
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x99fe2bd4d4554b91
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rcx, 0x44c5c0e03f356ac2
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rdx, 0xa958476dc992ad05
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs r8, 0x6cba7574ba332e8e
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs r9, 0xf6287893dca16207
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
movabs r10, 0xf5924ffaa3343df0
mov qword [rbp], r10
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x1c0]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqa xmm0, xmmword [rbp + 0x60]
vxorps xmm0, xmm0, xmmword [rbp + 0x1e0]
vmovdqa xmmword [rbp + 0x60], xmm0
movabs rax, 0x86777d1eb9e6d96d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0xdd41410945a5eef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0x84060af6b8c00d6b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0x94e63c95cc561285
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
movabs rax, 0x6c9794b6fd7fdbe7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0x44c5c0925e5f44f3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r10
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp + 0x1c0]
vmovdqa ymmword [rbp + 0x200], ymm1
vmovdqa xmm0, xmmword [rbp + 0x220]
vxorps xmm0, xmm0, xmmword [rbp + 0x1e0]
vmovdqa xmmword [rbp + 0x220], xmm0
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x200]
xor ecx, ecx
vzeroupper
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x140056dd9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r8, rsi
lea rdx, str.C:_boostanulljava_binjavaw.exe__Xmx
lea rcx, [rbp + 0x100]
call fcn.1400577c0
nop
lea r8, str.M__Djava.library.pathC:_boostanullclient_1_16_5_natives__cp_C:_boostanullclient_1_16_5libraries_C:_boostanulljava_binjavaw.dll_net.minecraft.client.main.Main___username_123123___width_854___height_480___version_1.12.2___gameDir_C:_boostanullclient_1_16_5___assetsDir_C:_boostanullclient_1_16_5_assets___assetIndex_1.16___uuid_NA___accessToken_aeef7bc935f9420eb6314dea7ad7e1e5___userType_mojang
mov rdx, rax
lea rcx, [rbp + 0x1c0]
call fcn.140057920
nop
lea rcx, [rbp + 0x100]
call fcn.140057140
lea rcx, [rbp + 0x1c0]
call fcn.140056f80
mov rcx, rax
mov edx, 5
call qword [sym.imp.KERNEL32.dll_WinExec]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400579e0
lea rdx, [0x140057c40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov byte [0x14006e0d8], 1
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x140056e40
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056e3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056e3b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058f44
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.140058b30
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140046cf0
nop
call fcn.140046c50
int3