Function at 0x1400018f0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x9b0]
sub rsp, 0xab0
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x980], rax
cmp byte [0x14000c851], 0
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
jne 0x140002096
mov r8d, edx
mov qword [rsp + 0xae0], rsi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000208e
mov qword [rsp + 0xaa8], r12
lea rdx, [rbx + 0xad415e]
xor r12d, r12d
mov qword [rsp + 0xaa0], r13
mov qword [rsp + 0xa98], r14
lea r8, [rbp - 0x38]
mov rcx, rax
mov qword [rsp + 0xa90], r15
mov qword [rbp - 0x38], r12
lea r9d, [r12 + 8]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernelbase.dll
mov qword [rbp - 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0xf0]
mov r8d, 0x88d
lea rdx, [0x140008a60]
mov qword [rsp + 0x78], rax
call sub.VCRUNTIME140.dll_memcpy
movabs rax, 0x89242a0025a46de8
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
cmp qword [rbp - 0x38], rax
jne 0x140001a78
lea rax, [rbx + 0x517b8]
mov byte [0x14000c850], 1
mov qword [rsp + 0x40], rax
lea rcx, [rbx + 0x517b1]
lea rax, [rbx + 0xd1570]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rbx + 0xd1740]
lea rax, [rbx + 0xd1778]
mov qword [rsp + 0x38], 0x53e89
mov qword [rsp + 0x50], rax
lea rax, [rbx + 0xd17a8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
jmp 0x140001a81
mov qword [rsp + 0x38], 0x52d37
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xorps xmm0, xmm0
lea rcx, [rbp - 0x78]
movups xmmword [rbp - 0x78], xmm0
mov r13, rax
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov r14d, dword [rbp - 0x74]
mov r15d, 1
mov rcx, qword [rbp - 0x70]
lea rdi, [r14 - 1]
not rdi
and rdi, rbx
lea rax, [rdi - 0x7fffff00]
cmp rax, rcx
lea rdx, [rdi + 0x7fffff00]
cmovb rcx, rax
mov rax, rdi
sub rax, r14
mov qword [rsp + 0x68], rcx
cmp rax, rcx
jbe 0x140001b70
mov ecx, r14d
lea r12, [rdi + rcx]
cmp r12, rdx
jae 0x140001b6d
mov rdx, rdi
mov dword [rsp + 0x20], 0x40
sub rdx, rcx
mov r9d, 0x3000
mov rcx, r13
mov r8, r14
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov rcx, r13
test rax, rax
jne 0x1400020b3
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8, r14
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
jne 0x1400020b0
inc r15
lea rdx, [rdi + 0x7fffff00]
mov rcx, r15
mov rax, rdi
imul rcx, r14
sub rax, rcx
cmp rax, qword [rsp + 0x68]
ja 0x140001af1
xor r12d, r12d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r12
mov r9d, 0x88d
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0xf0]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14, qword [rsp + 0x70]
xor edx, edx
mov rax, qword [rsp + 0x40]
sub ebx, r14d
mov rdi, qword [rsp + 0x38]
sub ebx, 0x517bc
mov r15, qword [rsp + 0x30]
add rdi, r14
mov qword [rbp + 0xc3], rax
mov r9d, 0x3000
mov rax, qword [rsp + 0x78]
mov r8d, 0x1000
mov rcx, rsi
mov dword [rbp + 0xce], ebx
mov qword [rbp + 0xd7], rax
mov word [rbp + 0xa0], 0xb848
mov word [rbp + 0xaa], 0xc749
mov byte [rbp + 0xac], 0xc2
mov dword [rbp + 0xb1], 0x48108944
mov byte [rbp + 0xb5], 0xb8
mov dword [rbp + 0xbe], 0x487400c6
mov byte [rbp + 0xc2], 0xb8
mov word [rbp + 0xcb], 0xc749
mov byte [rbp + 0xcd], 0xc2
mov dword [rbp + 0xd2], 0x48108944
mov byte [rbp + 0xd6], 0xb8
mov word [rbp + 0xdf], 0xe0ff
mov qword [rbp + 0xa2], r15
mov dword [rbp + 0xad], 0x88d
mov qword [rbp + 0xb6], rdi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x40
mov word [rbp + 0x78], 0xb848
mov rbx, rax
mov qword [rbp + 0x7a], rax
lea rax, [rbp - 0x40]
mov word [rbp + 0x82], 0xe0ff
mov r8d, 0x1000
mov qword [rsp + 0x20], rax
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp - 0x40]
mov r9d, 0x40
mov r8d, 0x1000
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdi, qword [rbp - 0x80]
lea r8, [rbp - 0x30]
mov rdx, rdi
mov qword [rbp - 0x30], r12
mov r9d, 8
mov qword [rsp + 0x20], r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9d, 0x41
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0xa0]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 0xc
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x78]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r13, qword [rsp + 0xaa0]
mov dword [rbp - 0x44], r12d
nop
mov r9d, 4
mov qword [rsp + 0x20], r12
lea r8, [rbp - 0x44]
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [rbp - 0x44], 0x88d
jne 0x140001d30
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rbp - 0x30]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rsp + 0x48]
lea r8, str.https:__discord.gg_QQCXFMWqjc
mov r9d, 0x1d
mov qword [rsp + 0x20], r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x50]
mov r15, qword [rsp + 0xa90]
test rax, rax
je 0x140001dbf
mov r9d, 0x1e
mov qword [rsp + 0x20], r12
lea r8, str.https:__discord.gg_QQCXFMWqjc
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x140001de7
mov r9d, 0xf
mov qword [rsp + 0x20], r12
lea r8, str.R_U_B_Y_._C_C
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x140001e0f
mov r9d, 0x1b
mov qword [rsp + 0x20], r12
lea r8, str.BEST_SPOOFER_ON_THE_MARKET
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x140008718]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 1
mov byte [rbp - 0x48], 0xc3
mov rdx, rax
mov qword [rsp + 0x20], r12
lea r8, [rbp - 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r14 + 0x54532]
mov dword [rbp + 0x30], 0x3b25d6b8
mov r9d, 5
mov byte [rbp + 0x34], 0xff
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movaps xmm0, xmmword [0x140009320]
lea rdx, [r14 + 0xd33e0]
mov r9d, 0x10
mov qword [rsp + 0x20], r12
lea r8, [rbp - 0x28]
mov rcx, rsi
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
movaps xmm0, xmmword [0x140009310]
lea r8, [rbp - 0x18]
mov r9d, 0x10
mov qword [rsp + 0x20], r12
mov rcx, rsi
mov rbx, rax
lea rdx, [rax + 0x100]
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movaps xmm0, xmmword [0x140009330]
lea rdx, [rbx + 0x110]
mov r9d, 0x10
mov qword [rsp + 0x20], r12
lea r8, [rbp - 8]
mov rcx, rsi
movups xmmword [rbp - 8], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movaps xmm0, xmmword [0x140009330]
lea rdx, [rbx + 0x120]
mov r9d, 0x10
mov qword [rsp + 0x20], r12
lea r8, [rbp + 8]
mov rcx, rsi
movups xmmword [rbp + 8], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movaps xmm0, xmmword [0x140009330]
lea rdx, [rbx + 0x130]
mov r9d, 0x10
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x18]
mov rcx, rsi
movups xmmword [rbp + 0x18], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x38], 0xf905280f
mov dword [rbp + 0x3c], 0xf000000
mov dword [rbp + 0x40], 0xe48111
mov dword [rbp + 0x44], 0x280f0000
mov dword [rbp + 0x48], 0xfb05
mov dword [rbp + 0x4c], 0x81110f00
mov dword [rbp + 0x50], 0x214
mov dword [rbp + 0x54], 0xfd05280f
mov dword [rbp + 0x58], 0xf000000
mov dword [rbp + 0x5c], 0x2248111
mov dword [rbp + 0x60], 0x280f0000
mov dword [rbp + 0x64], 0xff05
mov dword [rbp + 0x68], 0x81110f00
mov dword [rbp + 0x6c], 0x234
mov r9d, 0x39
mov byte [rbp + 0x70], 0xc3
lea r8, [rbp + 0x38]
mov qword [rsp + 0x20], r12
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r14 + 0x314b3]
mov word [rbp + 0x88], 0xb848
mov r9d, 0xc
mov word [rbp + 0x92], 0xe0ff
lea r8, [rbp + 0x88]
mov qword [rbp + 0x8a], rbx
mov rcx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r14 + 0x6483]
mov dword [rbp + 0x28], 0xffffffb8
mov r9d, 5
mov byte [rbp + 0x2c], 0xff
lea r8, [rbp + 0x28]
mov qword [rsp + 0x20], r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r14 + 0x5ebe]
mov qword [rsp + 0x20], r12
mov r9d, 5
lea r8, [rbp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rsi
mov byte [0x14000c851], 1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0xa98]
mov r12, qword [rsp + 0xaa8]
mov rsi, qword [rsp + 0xae0]
mov rcx, qword [rbp + 0x980]
xor rcx, rsp
call fcn.140006590
add rsp, 0xab0
pop rdi
pop rbx
pop rbp
ret
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
jmp 0x140001b7c