Function at 0x1400052d0
Capabilities:
Create process on windows
Delete file
Delete registry value
Execute command
Get token membership
Query environment variable
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor ebx, ebx
mov word [rsp + 0x6c], 0x500
lea rax, [rsp + 0x60]
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
mov r8d, 0x20
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140005372
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140005367
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x70], ebx
jne 0x1400053b7
mov r8d, 0x104
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp - 0x80]
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [rsp + 0x70], ebx
je 0x140005861
lea rcx, str.ZGGB___Unturned_Spoofer___Loading_._._.
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call fcn.140002e40
lea rcx, str.echo_off
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [0x7ffe0014]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, str.title_ZGGB___Unturned_Spoofer____random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140008f1c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Unturned
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140005489
mov ebx, 0x7ffe0014
nop word [rax + rax]
lea rcx, str._e_31m_e_0m__Close_Unturned_first_n
call fcn.140002840
lea rcx, str.taskkill__f__im_Unturned.exe__t
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pause__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_off
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [rbx]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, str.title_ZGGB___Unturned_Spoofer____random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140008f1c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Unturned
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140005420
call fcn.140004c10
lea rcx, str._echo_e_34m___NOTE_:e_0m_______e_31mVersion:_1.3.1e_0m_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._echo_e_34m___NOTE_:e_0m_____e_31mAC_unban:_Working_e_0m_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._echo_e_34m___NOTE_:e_0m____e_31mServer_unban:_Working_e_0m_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo__e_92me_0m__Welcome__username_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Steam_Client_WebHelper
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140005516
lea rcx, str._echo_off
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._e_31m_e_0m__steamwebhelper_detected_n
call fcn.140002840
lea rcx, str.taskkill__f__im_steamwebhelper.exe__t___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.steamwebhelper
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000555d
lea rcx, str._echo_off
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._e_31m_e_0m__Close_SteamService_n
call fcn.140002840
lea rcx, str.taskkill__f__im_steamwebhelper.exe__t___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.SteamService
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400055a4
lea rcx, str._echo_off
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._e_31m_e_0m__SteamService_detected_n
call fcn.140002840
lea rcx, str.taskkill___F___IM_SteamService.exe___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.steam
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400055eb
lea rcx, str._echo_off
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._e_31m_e_0m__steam_detected__n
call fcn.140002840
lea rcx, str.taskkill__F__IM_steam.exe___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Unturned
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140005632
lea rcx, str._echo_off
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._e_31m_e_0m__Unturned_detected_n
call fcn.140002840
lea rcx, str.taskkill___F___IM_Unturned.exe___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._e_33m_e_0m__Removing_Trace_Files_._._._n
call fcn.140002840
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARESmartly_Dressed_GamesUnturned
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400056c8
mov rdx, qword [rsp + 0x60]
lea r8, str.CloudStorage
call fcn.140002a80
mov rcx, qword [rsp + 0x60]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
lea rdx, str._e_92me_0m__CloudStorageHash_h_already_removed_n
lea rcx, str._e_92me_0m__Removed_CloudStorageHash_h_n
cmovne rcx, rdx
call fcn.140002840
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400056d4
lea rcx, str._e_92me_0m__CloudStorageHash_h_already_removed_n
call fcn.140002840
mov r8d, 0x104
lea rdx, [rbp - 0x80]
lea rcx, str.ProgramFiles_x86_
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140005726
lea r8, str.Steam_steamappscommonUnturnedCloudConvenientSavedata.json
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, str._e_92me_0m__Removed_ConvenientSavedata.json_n
test eax, eax
jne 0x140005721
lea rcx, str._e_92me_0m__ConvenientSavedata.json_already_removed_n
call fcn.140002840
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._e_33m_e_0m__Loading_drivers_._._._n
call fcn.140002840
call fcn.140004f70
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._e_92me_0m__Successfuly_Spoofed
call fcn.140002840
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140002c10
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400028a0
test rax, rax
je 0x1400057b1
mov rdx, rax
lea rcx, str._e_92me_0m__Public_IPv4:___s__n
call fcn.140002840
jmp 0x1400057bd
lea rcx, str._e_31m_e_0m__Failed_to_get_Public_IPv4_n
call fcn.140002840
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_cpu_get_processorid
call fcn.1400049c0
test rax, rax
je 0x1400057eb
lea rdx, [rax + 0x16]
lea rcx, str._e_92me_0m__Processor_Id:_________s_n
call fcn.140002840
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_bios_get_serialnumber
call fcn.1400049c0
test rax, rax
je 0x140005819
lea rdx, [rax + 0x2c]
lea rcx, str._e_92me_0m__Bios_S_N:_____________s_n
call fcn.140002840
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_csproduct_get_uuid
call fcn.1400049c0
test rax, rax
je 0x140005847
lea rdx, [rax + 0x2c]
lea rcx, str._e_92me_0m__UUID:_________________s_n
call fcn.140002840
lea rcx, [0x140008c6c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pause__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140006140
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x1a0
pop rbp
ret