Function at 0x14004be60
Capabilities:
Access peb ldr_data
Check if file exists
Create thread
Encode data using xor
Enumerate processes
Execute command
Get common file path
Get file attributes
Hash data using fnv
Hide graphical window
Resolve function by parsing pe exports
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1400a2fc0]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor r12d, r12d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14004bf26
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14004bf26
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14004bf21
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14004bf00
cmp r8d, 0x9a9264ad
je 0x14004bf2b
test r9d, r9d
jne 0x14004bee0
mov rax, qword [rax]
jmp 0x14004beb0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov eax, dword [str.__RQV8]
mov dword [rsp + 0x70], eax
movzx eax, word [0x140087cbc]
mov word [rsp + 0x74], ax
mov byte [rsp + 0x70], 0x6e
xor byte [rsp + 0x71], 0x34
xor byte [rsp + 0x72], 0x35
xor byte [rsp + 0x73], 0x36
xor al, 0x37
mov byte [rsp + 0x74], al
xor byte [rsp + 0x75], 0x38
lea rcx, [rsp + 0x70]
call rdx
call fcn.140047530
mov rcx, qword [0x1400a3408]
call fcn.140046bf0
lea rcx, str.nigga_Private
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1400a3470], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1400a3474], eax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x14004c47b
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rax, [rbp + 0xc0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x14004c001
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.14003e920
nop
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 7
jb 0x14004c06d
lea rax, [rcx + 7]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x50]
add rbx, rcx
mov r8d, 7
lea rdx, str.Medal_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
lea rax, [rsp + 0x50]
jmp 0x14004c092
mov qword [rsp + 0x20], 7
lea r9, str.Medal_
movzx r8d, byte [rsp + 0x40]
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.14003ee10
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14004c101
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c0fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c0fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004c560
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14004c179
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Please_open_Medal.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14004c497
inc rdx
mov rcx, qword [rsp + 0x70]
mov r8, rcx
cmp rdx, 0x1000
jb 0x14004c16f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x14004c1ac
call fcn.14004c560
jmp 0x14004c497
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14004c1b8
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c1b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c1b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004c560
lea rcx, [0x140087d08]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..FUDDRIVER
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400a33a0], rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov dword [rbp - 0x70], 0x130
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14004c249
nop
lea rdx, str.Bodycam_Win64_Shipping.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14004c46d
lea rdx, [rbp - 0x70]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14004c220
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
mov dword [0x1400a3304], eax
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x50], 0x85b3b69
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x10
lea r8, [rsp + 0x50]
mov edx, 0x225918
mov rcx, qword [0x1400a33a0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x70]
mov qword [0x1400a3398], rax
lea rcx, [0x140087d08]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Please_Open_Bodycam.
call fcn.14001cd80
cmp qword [0x1400a33b0], 0
jne 0x14004c39d
lea r14, [rbp + 0x1f8]
movabs r15, 0xff00ff00ff00ff00
nop dword [rax + rax]
mov al, 0xb2
mov cl, 0x9e
mov dl, 0x96
mov r8b, 0x8a
mov r9b, 0x97
mov r10b, 0x94
mov r11b, 0x9b
mov bl, 0xd7
mov dil, 0xd8
xor esi, esi
xor al, 0xf0
mov byte [rsp + 0x70], al
xor cl, 0xf1
mov byte [rsp + 0x71], cl
xor dl, 0xf2
mov byte [rsp + 0x72], dl
xor r8b, 0xf3
mov byte [rsp + 0x73], r8b
xor r9b, 0xf4
mov byte [rsp + 0x74], r9b
xor r10b, 0xf5
mov byte [rsp + 0x75], r10b
xor r11b, 0xf6
mov byte [rsp + 0x76], r11b
xor bl, 0xf7
mov byte [rsp + 0x77], bl
xor dil, 0xf8
mov byte [rsp + 0x78], dil
mov byte [rsp + 0x79], sil
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r14
mov rbx, qword [r14]
mov rax, rbx
xor rax, r15
mov qword [rsp + 0x50], rax
mov qword [r14], r12
mov rax, qword [0x1400a31b8]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call rax
nop
mov qword [r14], rbx
mov qword [0x1400a33b0], rax
test rax, rax
je 0x14004c2f0
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [0x1400a3398], 0
jne 0x14004c3dd
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Base_Address_is_0
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call fcn.14004cc10
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003edc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14004c4cc
cmp dword [rsp + 0x58], 0
je 0x14004c4dc
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14004c4dc
mov rcx, qword [0x1400a3410]
call fcn.140046260
mov rcx, qword [0x1400a3410]
call fcn.140046910
mov rcx, qword [0x1400a3410]
call fcn.14004b5f0
xor eax, eax
jmp 0x14004c49c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x68]
jmp 0x14004c255
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_get_Medal.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14004c680
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov dword [rsp + 0x58], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3