Function at 0x1400114f6
Capabilities:
Delete file
Execute command
Move file
Set console window title

Disassembly:
jmp 0x14001a3f0
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x62
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002a040]
xor rax, rbp
mov qword [rbp + 0x238], rax
lea rcx, [0x140030141]
call fcn.140011749
nop
lea rcx, str._n_n__I
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, str.NFO:ionkeys
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x1400259f8]
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x1400259fc]
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x140025a00]
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x140025a04]
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x140025a08]
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x140025a0c]
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x140025a10]
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x140025a14]
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x140025a18]
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x140025a1c]
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x140025a20]
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x140025a24]
call fcn.140011811
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x140025a28]
call fcn.140011811
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
call fcn.1400115d7
nop
call fcn.14001175d
nop
call fcn.1400114dd
nop
mov edx, 0x10
lea rcx, [rbp + 0x10]
call fcn.1400117df
nop
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov edx, 8
lea rcx, [rbp + 0x198]
call fcn.1400117c1
mov qword [rbp + 0x228], rax
mov rax, qword [rbp + 0x228]
mov qword [rbp + 0x230], rax
lea r8, [0x140025a2c]
mov rdx, qword [rbp + 0x230]
lea rcx, [rbp + 0x98]
call fcn.1400116b8
nop
lea rcx, [rbp + 0x198]
call fcn.14001114f
nop
lea rcx, [rbp + 0x98]
call fcn.1400110aa
mov qword [rbp + 0x228], rax
lea rcx, [rbp + 0x1d8]
call fcn.14001121c
mov qword [rbp + 0x230], rax
mov rcx, qword [rbp + 0x230]
call fcn.1400110aa
mov rcx, qword [rbp + 0x228]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_rename]
lea rcx, [rbp + 0x1d8]
call fcn.14001114f
nop
call fcn.14001105a
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x140025a34]
call qword [sym.imp.ucrtbased.dll_system]
nop
call fcn.14001166d
nop
lea rcx, str._n_n_____press_some_key_to_spoof_n
call fcn.140011811
nop
call qword [sym.imp.ucrtbased.dll__getch]
nop
mov ecx, 0x247
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, str._n_____spoofing__wait_n
call fcn.140011811
nop
mov ecx, 0x247
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
call fcn.140011262
nop
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
call fcn.140011555
nop
mov ecx, 0x247
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, str._n_____spoofed_as_well_please_check_your_serial..._n
call fcn.14001164f
nop
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, str.C:WindowsSystem32kdmapper.exe
call qword [sym.imp.ucrtbased.dll_remove]
nop
lea rcx, str.C:WindowsSystem32drvsamu.sys
call qword [sym.imp.ucrtbased.dll_remove]
nop
lea rcx, str.C:WindowsSystem32_apple.exe
call qword [sym.imp.ucrtbased.dll_remove]
nop
lea rcx, str.C:WindowsSystem32deep.bat
call qword [sym.imp.ucrtbased.dll_remove]
nop
lea rcx, str.C:WindowsSystem32mac.bat
call qword [sym.imp.ucrtbased.dll_remove]
nop
mov ecx, 0x10d1
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov dword [rbp + 0x214], 0
lea rcx, [rbp + 0x98]
call fcn.14001114f
mov eax, dword [rbp + 0x214]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140024b50]
call fcn.140011618
mov eax, edi
mov rcx, qword [rbp + 0x238]
xor rcx, rbp
call fcn.14001137f
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret