Function at 0x140053640
Capabilities:
Access peb ldr_data
Check if file exists
Create thread
Encode data using xor
Enumerate processes
Execute command
Get common file path
Get file attributes
Hash data using fnv
Hide graphical window
Resolve function by parsing pe exports
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1400d2c00]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor r12d, r12d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140053706
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140053706
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140053701
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400536e0
cmp r8d, 0x9a9264ad
je 0x14005370b
test r9d, r9d
jne 0x1400536c0
mov rax, qword [rax]
jmp 0x140053690
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
movsd xmm0, qword [str.kW_KpR___3B]
movsd qword [rsp + 0x70], xmm0
movzx ecx, word [0x140090510]
mov word [rsp + 0x78], cx
movzx eax, byte [0x140090512]
mov byte [rsp + 0x70], 0x53
xor byte [rsp + 0x71], 0x39
xor byte [rsp + 0x72], 0x3a
xor byte [rsp + 0x73], 0x3b
xor byte [rsp + 0x74], 0x3c
xor byte [rsp + 0x75], 0x3d
xor byte [rsp + 0x76], 0x3e
xor byte [rsp + 0x77], 0x3f
xor cl, 0x40
mov byte [rsp + 0x78], cl
xor byte [rsp + 0x79], 0x41
xor al, 0x42
mov byte [rsp + 0x7a], al
lea rcx, [rsp + 0x70]
call rdx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14004a3d0
mov rcx, qword [0x1400d3050]
call fcn.140049ad0
lea rcx, str.Droused_Private
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1400d30c8], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1400d30cc], eax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140053c9b
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rax, [rbp + 0xc0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x140053820
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.14003ece0
nop
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 7
jb 0x14005388c
lea rax, [rcx + 7]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x50]
add rbx, rcx
mov r8d, 7
lea rdx, str.Medal_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
lea rax, [rsp + 0x50]
jmp 0x1400538b1
mov qword [rsp + 0x20], 7
lea r9, str.Medal_
movzx r8d, byte [rsp + 0x40]
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.14003f1d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140053920
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005391b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005391b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053d80
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140053998
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Please_open_Medal.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140053cb7
inc rdx
mov rcx, qword [rsp + 0x70]
mov r8, rcx
cmp rdx, 0x1000
jb 0x14005398e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1400539cb
call fcn.140053d80
jmp 0x140053cb7
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400539d7
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400539d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400539d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053d80
lea rcx, [0x140090504]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..MedusaNewCom
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400d3020], rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov dword [rbp - 0x70], 0x130
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140053a69
nop
lea rdx, str.Bodycam_Win64_Shipping.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x140053c8d
lea rdx, [rbp - 0x70]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140053a40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1400d2f7c]
mov dword [0x1400d2f7c], eax
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x50], 0x85b3e20
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x10
lea r8, [rsp + 0x50]
mov edx, 0x220268
mov rcx, qword [0x1400d3020]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x70]
mov qword [0x1400d3028], rax
lea rcx, [0x140090504]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Please_Open_Bodycam.
call fcn.14001cdf0
cmp qword [0x1400d2f40], 0
jne 0x140053bbd
lea r14, [rbp + 0x1f8]
movabs r15, 0xff00ff00ff00ff00
nop
mov al, 0x88
mov cl, 0xa4
mov dl, 0xa8
mov r8b, 0xb4
mov r9b, 0xad
mov r10b, 0xae
mov r11b, 0xbd
mov bl, 0xf1
mov dil, 0xf2
xor esi, esi
xor al, 0xca
mov byte [rsp + 0x70], al
xor cl, 0xcb
mov byte [rsp + 0x71], cl
xor dl, 0xcc
mov byte [rsp + 0x72], dl
xor r8b, 0xcd
mov byte [rsp + 0x73], r8b
xor r9b, 0xce
mov byte [rsp + 0x74], r9b
xor r10b, 0xcf
mov byte [rsp + 0x75], r10b
xor r11b, 0xd0
mov byte [rsp + 0x76], r11b
xor bl, 0xd1
mov byte [rsp + 0x77], bl
xor dil, 0xd2
mov byte [rsp + 0x78], dil
mov byte [rsp + 0x79], sil
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r14
mov rbx, qword [r14]
mov rax, rbx
xor rax, r15
mov qword [rsp + 0x50], rax
mov qword [r14], r12
mov rax, qword [0x1400d2e28]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call rax
nop
mov qword [r14], rbx
mov qword [0x1400d2f40], rax
test rax, rax
je 0x140053b10
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [0x1400d3028], 0
jne 0x140053bfd
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Base_Address_is_0
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call fcn.140054430
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003f180]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140053cec
cmp dword [rsp + 0x58], 0
je 0x140053cfc
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140053cfc
mov rcx, qword [0x1400d3058]
call fcn.140049120
mov rcx, qword [0x1400d3058]
call fcn.1400497f0
mov rcx, qword [0x1400d3058]
call fcn.14004e610
xor eax, eax
jmp 0x140053cbc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x68]
jmp 0x140053a78
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_get_Medal.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140053ea0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov dword [rsp + 0x58], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3