Function at 0x14004d770
Capabilities:
Access peb ldr_data
Check if file exists
Create thread
Encode data using xor
Enumerate processes
Execute command
Get common file path
Get file attributes
Hash data using fnv
Hide graphical window
Resolve function by parsing pe exports
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1400cbbc0]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor r15d, r15d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14004d836
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14004d836
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14004d831
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14004d810
cmp r8d, 0x9a9264ad
je 0x14004d83b
test r9d, r9d
jne 0x14004d7f0
mov rax, qword [rax]
jmp 0x14004d7c0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r11d, dword [rcx + rax*4]
add r11, r10
mov rax, qword [str.sJVOHYY_Droused_Private]
mov qword [rsp + 0x70], rax
cmp byte [0x140088f17], r15b
je 0x14004d9a3
cmp dword [0x1400cbc20], 2
jl 0x14004d961
movdqa xmm4, xmmword [0x140089110]
movdqa xmm2, xmmword [0x1400564a0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140089080]
psubd xmm2, xmm0
andps xmm2, xmmword [0x140089090]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400890a0]
movd xmm0, dword [rsp + 0x70]
xorps xmm2, xmm0
movd dword [rsp + 0x70], xmm2
movdqa xmm2, xmmword [0x140089070]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140089080]
psubd xmm2, xmm0
andps xmm2, xmmword [0x140089090]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400890a0]
movd xmm0, dword [rsp + 0x74]
xorps xmm2, xmm0
movd dword [rsp + 0x74], xmm2
jmp 0x14004d9a3
lea r9, [rsp + 0x70]
mov r8d, r15d
nop dword [rax]
mov eax, 0xa0a0a0a1
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x33
movzx eax, r8b
sub al, cl
add al, 0x37
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x14004d970
lea rcx, [rsp + 0x70]
call r11
call fcn.1400481a0
mov rcx, qword [0x1400cc200]
call fcn.140047740
lea rcx, [0x140088f18]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1400cc268], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1400cc26c], eax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x14004debc
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rax, [rbp + 0xc0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x14004da30
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.14003e990
nop
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 7
jb 0x14004da9c
lea rax, [rcx + 7]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x50]
add rbx, rcx
mov r8d, 7
lea rdx, str.Medal_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
lea rax, [rsp + 0x50]
jmp 0x14004dac1
mov qword [rsp + 0x20], 7
lea r9, str.Medal_
movzx r8d, byte [rsp + 0x40]
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.14003ee80
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14004db30
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004db2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004db2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004dfa0
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14004dba8
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Please_open_Medal.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14004ded8
inc rdx
mov rcx, qword [rsp + 0x70]
mov r8, rcx
cmp rdx, 0x1000
jb 0x14004db9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x14004dbdb
call fcn.14004dfa0
jmp 0x14004ded8
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14004dbe7
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dbe2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004dbe2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004dfa0
call fcn.140047c00
call fcn.140047c00
lea rcx, [0x140088e88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..MedusaNewCom
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400cc1d0], rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov dword [rbp - 0x70], 0x130
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14004dc89
nop dword [rax + rax]
lea rdx, str.Bodycam_Win64_Shipping.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14004deae
lea rdx, [rbp - 0x70]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14004dc60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1400cc124]
mov dword [0x1400cc124], eax
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x50], 0x85b3e20
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x10
lea r8, [rsp + 0x50]
mov edx, 0x220268
mov rcx, qword [0x1400cc1d0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x70]
mov qword [0x1400cc1d8], rax
lea rcx, [0x140088e88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Please_Open_Bodycam.
call fcn.14001cdf0
cmp qword [0x1400cbf68], 0
jne 0x14004ddde
lea r14, [rbp + 0x1f8]
movabs r12, 0xff00ff00ff00ff00
nop
mov al, 0x13
mov cl, 0x3d
mov dl, 0x37
mov r8b, 0x2d
mov r9b, 0x36
movzx r10d, dl
mov r11b, 0x3a
mov bl, 0x78
mov dil, 0x79
xor esi, esi
xor al, 0x51
mov byte [rsp + 0x70], al
xor cl, 0x52
mov byte [rsp + 0x71], cl
xor dl, 0x53
mov byte [rsp + 0x72], dl
xor r8b, 0x54
mov byte [rsp + 0x73], r8b
xor r9b, 0x55
mov byte [rsp + 0x74], r9b
xor r10b, 0x56
mov byte [rsp + 0x75], r10b
xor r11b, 0x57
mov byte [rsp + 0x76], r11b
xor bl, 0x58
mov byte [rsp + 0x77], bl
xor dil, 0x59
mov byte [rsp + 0x78], dil
mov byte [rsp + 0x79], sil
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r14
mov rbx, qword [r14]
mov rax, rbx
xor rax, r12
mov qword [rsp + 0x50], rax
mov qword [r14], r15
mov rax, qword [0x1400cbfe8]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call rax
nop
mov qword [r14], rbx
mov qword [0x1400cbf68], rax
test rax, rax
je 0x14004dd30
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [0x1400cc1d8], 0
jne 0x14004de1e
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Base_Address_is_0
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call fcn.14004e650
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14003ee30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14004df0d
cmp dword [rsp + 0x58], 0
je 0x14004df1d
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14004df1d
mov rcx, qword [0x1400cc208]
call fcn.140046d40
mov rcx, qword [0x1400cc208]
call fcn.140047460
mov rcx, qword [0x1400cc208]
call fcn.14004c6c0
xor eax, eax
jmp 0x14004dedd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x68]
jmp 0x14004dc98
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_get_Medal.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14004e0c0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov dword [rsp + 0x58], r15d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3