Function at 0x14002fcb0
Capabilities:
Delete file
Download url
Execute command
Receive data
Terminate process

Disassembly:
push rbp
push rdi
push r13
lea rbp, [rsp - 0x100]
sub rsp, 0x200
xorps xmm0, xmm0
mov ecx, 0x30
movups xmmword [rbp + 0x18], xmm0
call fcn.14003189c
movups xmm1, xmmword [str.https:__pastebin.com_raw_9Kx8vxb6]
lea rdx, [rbp + 0x18]
mov qword [rbp + 0x18], rax
movdqa xmm0, xmmword [0x14003cb80]
movdqu xmmword [rbp + 0x28], xmm0
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x14003c1a0]
movups xmmword [rax + 0x10], xmm0
movzx ecx, byte [0x14003c1b0]
mov byte [rax + 0x20], cl
lea rcx, [rbp - 0x60]
mov byte [rax + 0x21], 0
call fcn.14002fa80
mov rdi, qword [rbp - 0x60]
lea rcx, [rbp - 0x60]
mov r13, qword [rbp - 0x48]
mov r8, qword [rbp - 0x50]
cmp r13, 0xf
mov qword [rbp - 0x38], rdi
cmova rcx, rdi
cmp r8, 7
jne 0x140031064
lea rdx, str.Updated
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140031064
mov qword [rsp + 0x220], rbx
mov qword [rsp + 0x228], rsi
mov qword [rsp + 0x1f0], r15
mov qword [rsp + 0x230], r12
mov qword [rsp + 0x1f8], r14
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm7
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x90]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rax, [0x14002f930]
mov dword [rbp + 0x40], 0x50
xor r15d, r15d
mov qword [rbp + 0x48], rax
xor ecx, ecx
mov dword [rbp + 0x44], 0x40
mov qword [rbp + 0x50], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xorps xmm0, xmm0
mov qword [rbp + 0x88], r15
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x60], xmm0
lea rbx, [0x14003c268]
movdqa xmmword [rbp + 0x70], xmm1
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x80], rbx
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rcx, qword [rbp + 0x58]
mov r8, rbx
mov eax, dword [rbp + 0x9c]
cdq
mov qword [rsp + 0x58], r15
sub eax, edx
mov qword [rsp + 0x50], rcx
sar eax, 1
xor ecx, ecx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], 0xb4
lea r9d, [rax - 0x5a]
mov dword [rsp + 0x30], 0x15e
mov eax, dword [rbp + 0x98]
cdq
mov dword [rsp + 0x28], r9d
sub eax, edx
mov r9d, 0x80000000
mov rdx, qword [rbp + 0x80]
sar eax, 1
sub eax, 0xaf
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea r9d, [r15 + 1]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov rsi, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea ecx, [r15 + 0x20]
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [0x140043408], rax
mov rcx, rax
test rax, rax
je 0x140030fa3
lea rdx, [0x140043410]
mov qword [0x140043420], r15
mov qword [rsp + 0x30], rdx
lea r8d, [r15 + 1]
lea rdx, [0x140043420]
mov qword [0x14004342c], r15
mov qword [rsp + 0x28], rdx
mov r9, rsi
mov dword [0x140043434], r15d
xor edx, edx
mov qword [0x14004343c], r15
mov dword [0x140043444], r15d
mov qword [0x140043454], r15
mov dword [0x140043448], 1
mov dword [0x140043438], 1
mov dword [0x140043428], r15d
mov dword [0x14004344c], 1
mov dword [0x140043450], 0x50
mov dword [0x14004345c], 0x80000000
mov rax, qword [rax]
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
js 0x140030f9c
lea edx, [r15 + 0xa]
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_UpdateWindow]
mov dword [rsp + 0x30], 3
lea rdx, [r15 - 1]
mov dword [rsp + 0x28], r15d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r15d
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, qword [0x1400433a0]
test rax, rax
je 0x14002ff7d
inc dword [rax + 0x3bc]
mov ecx, 0x3e88
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14002ff99
xor edx, edx
mov rcx, rax
call fcn.140001250
jmp 0x14002ff9c
mov rax, r15
cmp qword [0x1400433a0], r15
jne 0x14002ffac
mov qword [0x1400433a0], rax
mov rcx, rax
call fcn.140006c60
mov rcx, qword [0x1400433a0]
test rcx, rcx
jne 0x14002ffe1
mov r8d, 0xcae
lea rdx, str.C:UsersLucasDesktopSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1400433a0]
movss xmm2, dword [0x14003cadc]
lea rax, [0x14003b7c8]
mov rcx, qword [rcx + 0xa8]
mov qword [rsp + 0x20], rax
call fcn.140021970
xor ecx, ecx
call fcn.14001d120
lea rcx, [0x140043400]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14003012a
lea rcx, [0x1400433f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003012a
mov rax, qword [0x1400433a0]
mov qword [0x1400433f0], rsi
test rax, rax
jne 0x140030066
mov r8d, 0xcae
lea rdx, str.C:UsersLucasDesktopSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1400433a0]
or dword [rax + 0xc], 6
lea rcx, str.imgui_impl_win32
mov qword [rax + 0xd8], rcx
mov qword [rax + 0x120], rsi
mov dword [rax + 0x3c], 9
mov dword [rax + 0x40], 0x25
mov dword [rax + 0x44], 0x27
mov dword [rax + 0x48], 0x26
mov dword [rax + 0x4c], 0x28
mov dword [rax + 0x50], 0x21
mov dword [rax + 0x54], 0x22
mov dword [rax + 0x58], 0x24
mov dword [rax + 0x5c], 0x23
mov dword [rax + 0x60], 0x2d
mov dword [rax + 0x64], 0x2e
mov dword [rax + 0x68], 8
mov dword [rax + 0x6c], 0x20
mov dword [rax + 0x70], 0xd
mov dword [rax + 0x74], 0x1b
mov dword [rax + 0x78], 0xd
mov dword [rax + 0x7c], 0x41
mov dword [rax + 0x80], 0x43
mov dword [rax + 0x84], 0x56
mov dword [rax + 0x88], 0x58
mov dword [rax + 0x8c], 0x59
mov dword [rax + 0x90], 0x5a
jmp 0x140030131
mov rax, qword [0x1400433a0]
mov rbx, qword [0x140043410]
test rax, rax
jne 0x14003015e
mov r8d, 0xcae
lea rdx, str.C:UsersLucasDesktopSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1400433a0]
or dword [rax + 0xc], 8
lea rcx, str.imgui_impl_dx9
mov qword [rax + 0xe0], rcx
mov rcx, rbx
mov rax, qword [rbx]
mov qword [0x1400433d8], rbx
call qword [rax + 8]
mov rbx, qword [0x1400433a0]
test rbx, rbx
jne 0x1400301ad
mov r8d, 0x8d1
lea rdx, str.C:UsersLucasDesktopSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400433a0]
mov dword [rbx + 0x1574], r15d
mov dword [rbx + 0x15a8], 0x40400000
mov dword [rbx + 0x1584], 0x3f000000
mov dword [rbx + 0x1588], 0x3f000000
test rbx, rbx
jne 0x1400301f8
mov r8d, 0x8d1
lea rdx, str.C:UsersLucasDesktopSpooferSpooferimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400433a0]
xor ecx, ecx
call fcn.14001d120
mov dword [rbx + 0x1620], 0x3f5c28f6
mov dword [rbx + 0x1624], 0x3f6e147b
mov dword [rbx + 0x1628], 0x3f63d70a
mov dword [rbx + 0x162c], 0x3f47ae14
mov dword [rbx + 0x1630], 0x3f5c28f6
mov dword [rbx + 0x1634], 0x3f6e147b
mov dword [rbx + 0x1638], 0x3f63d70a
mov dword [rbx + 0x163c], 0x3e8f5c29
mov dword [rbx + 0x1640], 0x3e051eb8
mov dword [rbx + 0x1644], 0x3e0f5c29
mov dword [rbx + 0x1648], 0x3e2e147b
mov dword [rbx + 0x164c], 0x3f800000
mov dword [rbx + 0x1670], 0x3e9eb852
mov dword [rbx + 0x1674], 0x3e9eb852
mov qword [rbx + 0x1678], 0x3f800000
mov qword [rbx + 0x1680], r15
mov qword [rbx + 0x1688], r15
mov dword [rbx + 0x1690], 0x3e4ccccd
mov dword [rbx + 0x1694], 0x3e6147ae
mov dword [rbx + 0x1698], 0x3e8a3d71
mov dword [rbx + 0x169c], 0x3f800000
mov dword [rbx + 0x16a0], 0x3f6b851f
mov dword [rbx + 0x16a4], 0x3e3851ec
mov dword [rbx + 0x16a8], 0x3e947ae1
mov dword [rbx + 0x16ac], 0x3f47ae14
mov dword [rbx + 0x16b0], 0x3f6b851f
mov dword [rbx + 0x16b4], 0x3e3851ec
mov dword [rbx + 0x16b8], 0x3e947ae1
mov dword [rbx + 0x16bc], 0x3f800000
mov dword [rbx + 0x16c0], 0x3e4ccccd
mov dword [rbx + 0x16c4], 0x3e6147ae
mov dword [rbx + 0x16c8], 0x3e8a3d71
mov dword [rbx + 0x16cc], 0x3f800000
mov dword [rbx + 0x16e0], 0x3e4ccccd
mov dword [rbx + 0x16e4], 0x3e6147ae
mov dword [rbx + 0x16e8], 0x3e8a3d71
mov dword [rbx + 0x16ec], 0x3f400000
mov dword [rbx + 0x16d0], 0x3f6b851f
mov dword [rbx + 0x16d4], 0x3e3851ec
mov dword [rbx + 0x16d8], 0x3e947ae1
mov dword [rbx + 0x16dc], 0x3f800000
mov dword [rbx + 0x16f0], 0x3e4ccccd
mov dword [rbx + 0x16f4], 0x3e6147ae
mov dword [rbx + 0x16f8], 0x3e8a3d71
mov dword [rbx + 0x16fc], 0x3ef0a3d7
mov dword [rbx + 0x1700], 0x3e4ccccd
mov dword [rbx + 0x1704], 0x3e6147ae
mov dword [rbx + 0x1708], 0x3e8a3d71
mov dword [rbx + 0x170c], 0x3f800000
mov dword [rbx + 0x1710], 0x3db851ec
mov dword [rbx + 0x1714], 0x3e19999a
mov dword [rbx + 0x1718], 0x3e23d70a
mov dword [rbx + 0x171c], 0x3f800000
mov dword [rbx + 0x1720], 0x3f6b851f
mov dword [rbx + 0x1724], 0x3e3851ec
mov dword [rbx + 0x1728], 0x3e947ae1
mov dword [rbx + 0x172c], 0x3f47ae14
mov dword [rbx + 0x1730], 0x3f6b851f
mov dword [rbx + 0x1734], 0x3e3851ec
mov dword [rbx + 0x1738], 0x3e947ae1
mov dword [rbx + 0x173c], 0x3f800000
mov dword [rbx + 0x1740], 0x3f35c28f
mov dword [rbx + 0x1744], 0x3e6147ae
mov dword [rbx + 0x1748], 0x3e8a3d71
mov dword [rbx + 0x174c], 0x3f800000
mov dword [rbx + 0x1750], 0x3ef0a3d7
mov dword [rbx + 0x1754], 0x3f451eb8
mov dword [rbx + 0x1758], 0x3f547ae1
mov dword [rbx + 0x175c], 0x3e0f5c29
mov dword [rbx + 0x1760], 0x3f6b851f
mov dword [rbx + 0x1764], 0x3e3851ec
mov dword [rbx + 0x1768], 0x3e947ae1
mov dword [rbx + 0x176c], 0x3f800000
mov dword [rbx + 0x1770], 0x3ef0a3d7
mov dword [rbx + 0x1774], 0x3f451eb8
mov dword [rbx + 0x1778], 0x3f547ae1
mov dword [rbx + 0x177c], 0x3e0f5c29
mov dword [rbx + 0x1780], 0x3f6b851f
mov dword [rbx + 0x1784], 0x3e3851ec
mov dword [rbx + 0x1788], 0x3e947ae1
xor eax, eax
mov dword [rbx + 0x178c], 0x3f5c28f6
xorps xmm0, xmm0
mov dword [rbx + 0x1790], 0x3f6b851f
mov dword [rbx + 0x1794], 0x3e3851ec
mov dword [rbx + 0x1798], 0x3e947ae1
lea ecx, [rax + 0x30]
mov dword [rbx + 0x179c], 0x3f800000
mov dword [rbx + 0x17a0], 0x3f6b851f
mov dword [rbx + 0x17a4], 0x3e3851ec
mov dword [rbx + 0x17a8], 0x3e947ae1
mov dword [rbx + 0x17ac], 0x3f428f5c
mov dword [rbx + 0x17b0], 0x3f6b851f
mov dword [rbx + 0x17b4], 0x3e3851ec
mov dword [rbx + 0x17b8], 0x3e947ae1
mov dword [rbx + 0x17bc], 0x3f5c28f6
mov dword [rbx + 0x17c0], 0x3f6b851f
mov dword [rbx + 0x17c4], 0x3e3851ec
mov dword [rbx + 0x17c8], 0x3e947ae1
mov dword [rbx + 0x17cc], 0x3f800000
mov dword [rbx + 0x17d0], 0x3e0f5c29
mov dword [rbx + 0x17d4], 0x3e23d70a
mov dword [rbx + 0x17d8], 0x3e428f5c
mov dword [rbx + 0x17dc], 0x3f800000
mov dword [rbx + 0x17e0], 0x3f6b851f
mov dword [rbx + 0x17e4], 0x3e3851ec
mov dword [rbx + 0x17e8], 0x3e947ae1
mov dword [rbx + 0x17ec], 0x3f47ae14
mov dword [rbx + 0x17f0], 0x3f6b851f
mov dword [rbx + 0x17f4], 0x3e3851ec
mov dword [rbx + 0x17f8], 0x3e947ae1
mov dword [rbx + 0x17fc], 0x3f800000
mov dword [rbx + 0x1800], 0x3ef0a3d7
mov dword [rbx + 0x1804], 0x3f451eb8
mov dword [rbx + 0x1808], 0x3f547ae1
mov dword [rbx + 0x180c], 0x3d23d70a
mov dword [rbx + 0x1810], 0x3f6b851f
mov dword [rbx + 0x1814], 0x3e3851ec
mov dword [rbx + 0x1818], 0x3e947ae1
mov dword [rbx + 0x181c], 0x3f47ae14
mov dword [rbx + 0x1820], 0x3f6b851f
mov dword [rbx + 0x1824], 0x3e3851ec
mov dword [rbx + 0x1828], 0x3e947ae1
mov dword [rbx + 0x182c], 0x3f800000
mov dword [rbx + 0x1880], 0x3f5c28f6
mov dword [rbx + 0x1884], 0x3f6e147b
mov dword [rbx + 0x1888], 0x3f63d70a
mov dword [rbx + 0x188c], 0x3f2147ae
mov dword [rbx + 0x1890], 0x3f6b851f
mov dword [rbx + 0x1894], 0x3e3851ec
mov dword [rbx + 0x1898], 0x3e947ae1
mov dword [rbx + 0x189c], 0x3f800000
mov dword [rbx + 0x18a0], 0x3f5c28f6
mov dword [rbx + 0x18a4], 0x3f6e147b
mov dword [rbx + 0x18a8], 0x3f63d70a
mov dword [rbx + 0x18ac], 0x3f2147ae
mov dword [rbx + 0x18b0], 0x3f6b851f
mov dword [rbx + 0x18b4], 0x3e3851ec
mov dword [rbx + 0x18b8], 0x3e947ae1
mov dword [rbx + 0x18bc], 0x3f800000
mov dword [rbx + 0x18c0], 0x3f6b851f
mov dword [rbx + 0x18c4], 0x3e3851ec
mov dword [rbx + 0x18c8], 0x3e947ae1
mov dword [rbx + 0x18cc], 0x3edc28f6
mov dword [rbx + 0x1660], 0x3e4ccccd
mov dword [rbx + 0x1664], 0x3e6147ae
mov dword [rbx + 0x1668], 0x3e8a3d71
mov dword [rbx + 0x166c], 0x3f666666
mov byte [rbp - 0x30], r15b
movups xmmword [rbp - 0x2f], xmm0
mov qword [rbp - 0x1f], rax
movups xmmword [rbp - 0x10], xmm0
call fcn.14003189c
movups xmm1, xmmword [str.https:__pastebin.com_raw_9qEASjhQ]
mov qword [rbp - 0x10], rax
movdqa xmm0, xmmword [0x14003cb80]
movdqu xmmword [rbp], xmm0
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x14003c2a8]
movups xmmword [rax + 0x10], xmm0
movzx ecx, byte [0x14003c2b8]
lea rdx, [rbp - 0x10]
mov byte [rax + 0x20], cl
lea rcx, [rbp - 0x60]
mov byte [rax + 0x21], r15b
call fcn.14002fa80
mov r12, qword [rbp - 0x50]
xorps xmm0, xmm0
mov r14, qword [rbp - 0x60]
xorps xmm6, xmm6
movss xmm7, dword [0x14003ca90]
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
nop dword [rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0xa0]
xor edx, edx
movabs rbx, 0x7fffffffffffffff
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14003087c
lea rcx, [rbp + 0xa0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor ebx, ebx
jmp 0x140030d8c
cmp byte [0x14004308c], 0
je 0x140030f93
lea rcx, [rbp - 0x40]
call fcn.14002f690
mov rax, qword [rbp - 0x40]
movabs rcx, 0x7ffffffffeced2ff
cmp rax, rcx
jge 0x1400308ac
lea rbx, [rax + 0x1312d00]
lea rcx, [rsp + 0x60]
call fcn.14002f690
mov rax, qword [rsp + 0x60]
cmp rax, rbx
jge 0x14003092c
movabs rdi, 0x431bde82d7b634db
movabs r12, 0x4e94914f0000
mov rcx, rbx
sub rcx, rax
cmp rcx, r12
jl 0x1400308e6
mov ecx, 0x5265c00
jmp 0x14003090b
mov rax, rdi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140030909
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x60]
call fcn.14002f690
mov rax, qword [rsp + 0x60]
cmp rax, rbx
jl 0x1400308d4
mov rdi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x50]
cmp qword [0x1400433c8], 0
jne 0x14003093b
call fcn.14002e950
call fcn.14002f020
call fcn.140005fb0
mov rax, qword [0x1400433a0]
lea rdx, [0x14004308c]
movaps xmm0, xmm6
lea rcx, str.Nebula_Services__Free
movaps xmm1, xmm6
unpcklps xmm0, xmm6
unpcklps xmm1, xmm6
mov r8d, 0x13e
mov dword [rax + 0x1b48], 0x43af0000
mov dword [rax + 0x1b4c], 0x43340000
mov dword [rax + 0x1b30], 2
or dword [rax + 0x1b28], 3
movsd qword [rax + 0x1b38], xmm0
movsd qword [rax + 0x1b40], xmm1
mov dword [rax + 0x1b2c], 2
call fcn.14000ac10
test r15b, r15b
jne 0x140030aed
mov rcx, qword [0x1400433a0]
mov rax, qword [rcx + 0x1a88]
mov byte [rax + 0x80], 1
mov rax, qword [rcx + 0x1a88]
cmp byte [rax + 0x83], r15b
jne 0x140030a1e
movss xmm1, dword [rcx + 0x15a4]
movss xmm0, dword [rax + 0xf4]
addss xmm1, xmm1
addss xmm1, dword [rcx + 0x1928]
maxss xmm0, xmm1
movss xmm1, dword [rax + 0x100]
movss dword [rax + 0xf4], xmm0
maxss xmm1, dword [rcx + 0x15a4]
movss dword [rax + 0x100], xmm1
lea rcx, str.Enter_Key:
call fcn.140027260
xor ebx, ebx
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rbx
lea r8, [rbp - 0x30]
mov dword [rsp + 0x28], ebx
lea rcx, str.username
lea r9d, [rbx + 0x19]
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.14002ad50
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rbx
lea rcx, str.Get_Key
call fcn.140027b00
test al, al
je 0x140030a8a
lea rcx, str.start_https:__loot_link.com_s_tTlb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x78], rbx
lea rcx, str.Login
call fcn.140027b00
test al, al
je 0x140030c9a
lea rcx, [rbp - 0x30]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], bl
jne 0x140030ab3
cmp qword [rbp - 0x48], 0xf
lea rcx, [rbp - 0x60]
cmova rcx, r14
cmp r12, rax
jne 0x140030c9a
mov r8, r12
lea rdx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140030c9a
mov r15b, 1
jmp 0x140030c9a
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], 0
lea rcx, str.Temp_Spoof
call fcn.140027b00
xor ebx, ebx
test al, al
je 0x140030ba4
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, [0x14003c4c0]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_945080778205851708_1221981398311895161_driver_temp.sys_ex66148ddcis660218dchm7dfedd83aae22ca728940438b813c5c707200eefe7475339a49e7f789585eebf
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, [0x14003c6a0]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1201634157655244912_1201641672908492821_kdmapper_Release.exe_ex66146304is6601ee04hm7c64d318d938193dd51348206c5ff03908c68e7ce175326a13c8d9f60fbca0f2
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Program_Files__kdmapper_Release.exe_driver_tem_.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:Program_Fileskdmapper_Release.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Program_Filesdriver_temp.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov r9d, 0x40040
lea r8, str.Nebula_Services
lea rdx, str.Done_Spoofing__Use_applecleaner_or_launch_fn
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rbp - 0x78]
mov qword [rbp - 0x78], 0
lea rcx, str.Perm__soon_
call fcn.140027b00
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], 0
lea rcx, str.Temp_Spoof_2
call fcn.140027b00
test al, al
je 0x140030c71
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, [0x14003c968]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_945080778205851708_1221980677466226728_new.sys_ex66148d30is66021830hm583d9cea8ff931451d690fc69fbcc8e1e6d6b664554259375f8e9297bd51f9d3
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, [0x14003c6a0]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1201634157655244912_1201641672908492821_kdmapper_Release.exe_ex66146304is6601ee04hm7c64d318d938193dd51348206c5ff03908c68e7ce175326a13c8d9f60fbca0f2
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Program_Files__kdmapper_Release.exe_new.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:Program_Fileskdmapper_Release.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Program_Files_new.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov r9d, 0x40040
lea r8, str.Nebula_Services
lea rdx, str.Done_Spoofing__Use_applecleaner_or_launch_fn
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rbp - 0x68]
mov qword [rbp - 0x68], 0
lea rcx, str.Join_Discord
call fcn.140027b00
test al, al
je 0x140030c9a
lea rcx, str.start_https:__discord.gg
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14000d080
call fcn.140007990
mov rcx, qword [0x140043410]
mov r9d, 3
mov dword [rsp + 0x30], ebx
xor r8d, r8d
movss dword [rsp + 0x28], xmm7
xor edx, edx
mov dword [rsp + 0x20], ebx
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x140043410]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x140030d12
call fcn.140007dd0
mov rax, qword [0x1400433a0]
mov rcx, rbx
add rax, 0x1d80
cmp byte [rax], 0
cmovne rcx, rax
call fcn.14002e370
mov rcx, qword [0x140043410]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x140043410]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140030d8c
mov rcx, qword [0x140043410]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x140030d8c
call fcn.14002eae0
mov rcx, qword [0x140043410]
lea rdx, [0x140043420]
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp eax, 0x8876086c
jne 0x140030d87
mov r8d, 0x2d
lea rdx, str.C:UsersLucasDesktopSpooferSpoofermain.h
lea rcx, [0x14003392c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
call fcn.14002e950
cmp dword [rbp + 0xa8], 0x12
jne 0x140030830
call fcn.14002eae0
mov rcx, qword [0x1400433d8]
test rcx, rcx
je 0x140030db7
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1400433d8], rbx
mov qword [0x1400433f0], rbx
mov rbx, qword [0x1400433a0]
mov rcx, rbx
call fcn.140006e60
xor r15d, r15d
cmp qword [0x1400433a0], rbx
jne 0x140030de0
mov qword [0x1400433a0], r15
test rbx, rbx
je 0x140030e08
mov rcx, rbx
call fcn.1400155c0
mov rax, qword [0x1400433a0]
test rax, rax
je 0x140030dff
dec dword [rax + 0x3bc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140043410]
test rcx, rcx
je 0x140030e21
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140043410], r15
mov rcx, qword [0x140043408]
test rcx, rcx
je 0x140030e3a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140043408], r15
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rax, qword [rbp - 0x48]
cmp rax, 0xf
jbe 0x140030e8f
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140030e87
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003104e
mov rcx, r14
call fcn.1400315e4
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140030eca
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030ec5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003104e
call fcn.1400315e4
movdqa xmm0, xmmword [0x14003cb70]
mov byte [rbp - 0x10], 0
movdqu xmmword [rbp], xmm0
cmp r13, 0xf
jbe 0x140030f12
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140030f0a
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003104e
mov rcx, rdi
call fcn.1400315e4
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x140030f4d
mov rcx, qword [rbp + 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030f48
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003104e
call fcn.1400315e4
xor eax, eax
movaps xmm6, xmmword [rsp + 0x1e0]
mov r12, qword [rsp + 0x230]
mov r14, qword [rsp + 0x1f8]
movaps xmm7, xmmword [rsp + 0x1d0]
mov rsi, qword [rsp + 0x228]
mov rbx, qword [rsp + 0x220]
mov r15, qword [rsp + 0x1f0]
add rsp, 0x200
pop r13
pop rdi
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x140043408]
mov rdx, qword [0x140043410]
test rdx, rdx
je 0x140030fc6
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov rcx, qword [0x140043408]
mov qword [0x140043410], r15
test rcx, rcx
je 0x140030fd8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140043408], r15
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.USER32.dll_UnregisterClassW]
cmp r13, 0xf
jbe 0x14003101c
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140031014
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003104e
mov rcx, rdi
call fcn.1400315e4
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x14003105a
mov rcx, qword [rbp + 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031055
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140031055
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400315e4
mov eax, 1
jmp 0x140030f4f
mov r9d, 0x40040
lea r8, str.Nebula_Services
lea rdx, str.Outdated_Download_Please_Download_New_Version
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, str.start_https:__discord.gg_W2CKd5cYuH
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3