Function at 0x140001000
Capabilities:
Create process on windows
Execute command
Set registry value

Disassembly:
sub rsp, 0x38
cmp byte [0x140081060], 0
je 0x14000173c
mov rcx, qword [0x140081880]
lea rdx, [0x140081060]
movss xmm1, dword [0x140081054]
xorps xmm2, xmm2
movss xmm0, dword [0x140081050]
mov r8d, 0x12a
unpcklps xmm0, xmm1
xorps xmm1, xmm1
mov eax, dword [rcx + 0x1dc0]
movsd qword [rcx + 0x1dd4], xmm0
or eax, 1
mov dword [rcx + 0x1dc4], 2
or eax, 0x42
mov byte [rcx + 0x1dfc], 1
unpcklps xmm1, xmm2
movsd qword [rcx + 0x1ddc], xmm1
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1e20], 0x3f800000
mov dword [rcx + 0x1de4], 0x43610000
mov dword [rcx + 0x1de8], 0x432f0000
mov dword [rcx + 0x1dc8], 1
lea rcx, str.Disappear
call fcn.14000e6b0
lea rdx, [0x140081862]
lea rcx, str.Standard_mode
call fcn.140043e60
lea rdx, [0x140081861]
lea rcx, str.Close_Explorer
call fcn.140043e60
lea rdx, [0x140081860]
lea rcx, str.Back
call fcn.140043e60
cmp byte [0x140081862], 0
je 0x140001103
cmp byte [0x140081861], 0
je 0x140001103
cmp byte [0x140081860], 0
je 0x140001103
mov byte [0x140081860], 0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
lea rcx, str.Start
call fcn.140042630
test al, al
je 0x1400015ad
cmp byte [0x140081862], 0
je 0x14000115f
mov dword [rsp + 0x28], 1
lea r8, str.C:HIDERLoaderIn_depth.exe
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea rdx, str.runas
mov byte [0x140081862], 0
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [0x140081861], 0
je 0x14000117c
lea rcx, str.taskkill__f__im_explorer.exe
mov byte [0x140081861], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x140081860], 0
je 0x1400015ad
lea rcx, str.attrib__s__h__C:HIDER___nul_2_nul
mov byte [0x140081860], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v_Hidden__t_REG_DWORD__d_1__f__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_explorer.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_explorer.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraft___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraft_versions___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:AExcellent.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:AExpensive.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:AWild.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Carbonara___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:CarbonaraAntiLeak___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsExclusive___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVendex___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVerist___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsWissend___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameRockstar_Free___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameFPDCLEINT_1.8___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameGothaj___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameInertia___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameImpact___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameStarLine___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameRise___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_arbuz___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameExclusive___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameEpfirium___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameDark___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsAvalon___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsCelestial___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsAvalon___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsExpensive___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsAurora___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraft_versionsExclusive___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraft_versionsVendex___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraft_versionsVerist___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraft_versionsWissend___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraftRockstar_Free___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraftFPDCLEINT_1.8___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraftGothaj___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraftInertia___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraftImpact___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraftStarLine___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraftRise___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraft_arbuz___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraftExclusive___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraftDark___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraftAvalon___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraftExpensive___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraftAurora___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h_Nursultan.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h_Expensive.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h_Excellent.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h_Akrien.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h_Celestial.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h_baritone__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h_Nurik__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h_Excellent__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h_Celka__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h_Celestial__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h_Akrien__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h_Nursultan__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsRockstar___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:GamesMinecraft_versionsRockstar___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Rockstar___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:RockAntiLeak___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Celestial___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Nurik___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:_baritone___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:AMinecraft_1.16.5.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:WILD___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Expensive___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Celka___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Excellent___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:AkrienAntiLeak___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Nurik___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:_baritone___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:AMinecraft_1.16.5.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:WILD___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Expensive___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Celka___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:Excellent___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib__s__h__C:AkrienAntiLeak___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
lea rcx, str.Support
call fcn.140042630
test al, al
je 0x1400015ec
mov rax, qword [0x140081880]
lea rdx, str.Support_Window
mov rcx, qword [rax + 0x1d18]
call fcn.1400060f0
mov ecx, eax
call fcn.140014150
mov rax, qword [0x140081880]
mov rax, qword [rax + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140001615
mov eax, dword [rax + 0x1f4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.140044550
lea rcx, str._F9__UnHook___
call fcn.140041d10
call fcn.140014a10
test al, al
je 0x140001733
lea rcx, str.1.F9__UnHook___
call fcn.140041d10
lea rcx, str.2.Standart_mode___maybe_ban
call fcn.140041d10
lea rcx, str.3.There_are_no_viruses__its_open_source
call fcn.140041d10
mov rax, qword [0x140081880]
mov rax, qword [rax + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x14000167b
mov eax, dword [rax + 0x1f4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.140044550
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
lea rcx, str.Telegram
call fcn.140042630
test al, al
je 0x1400016c3
mov dword [rsp + 0x28], 1
lea r8, str.https:__t.me_Zhukovskyy
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
lea rcx, str.Discord
call fcn.140042630
test al, al
je 0x14000170b
mov dword [rsp + 0x28], 1
lea r8, str.https:__discordapp.com_users_1160952295463333949_
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0x42f00000
lea rcx, [0x14004ea04]
call fcn.140042630
test al, al
je 0x14000172e
call fcn.140014720
call fcn.140014bf0
add rsp, 0x38
jmp fcn.140011920
add rsp, 0x38
ret