Function at 0x401c60
Capabilities:
Delete file
Execute command
Move file
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40473b
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str._n_n__I
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.NFO:ionkeys
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059d0
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059d4
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059d8
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059dc
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059e0
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059e4
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059e8
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059ec
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059f0
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059f4
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059f8
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059fc
call fcn.00403900
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x405a00
call fcn.00403900
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004017f0
call fcn.004016f0
call fcn.004015f0
push 0x10
lea eax, [ebp - 0x74]
push eax
call fcn.004014d0
add esp, 8
lea ecx, [ebp - 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 8
lea edx, [ebp - 0xb4]
push edx
call fcn.004013d0
add esp, 8
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x94], eax
mov dword [ebp - 4], 0
push 0x405a04
mov ecx, dword [ebp - 0x94]
push ecx
lea edx, [ebp - 0x8c]
push edx
call fcn.00402de0
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb4]
call fcn.00402040
lea eax, [ebp - 0xcc]
push eax
call fcn.004018f0
add esp, 4
mov dword [ebp - 0x98], eax
lea ecx, [ebp - 0x8c]
call fcn.00401fb0
push eax
mov ecx, dword [ebp - 0x98]
call fcn.00401fb0
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
add esp, 8
lea ecx, [ebp - 0xcc]
call fcn.00402040
call fcn.004019f0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x405a0c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
call fcn.00401950
push str._n_n_____press_some_key_to_spoof_n
call fcn.00403900
add esp, 4
call dword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
push 0x247
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._n_____spoofing__wait_n
call fcn.00403900
add esp, 4
push 0x247
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401ab0
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401b60
push 0x247
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._n_____spoofed_as_well_please_check_your_serial..._n
call fcn.00403900
add esp, 4
push 0x19
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.C:WindowsSystem32kdmapper.exe
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push str.C:WindowsSystem32drvsamu.sys
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push str.C:WindowsSystem32_apple.exe
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push str.C:WindowsSystem32deep.bat
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push str.C:WindowsSystem32mac.bat
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push 0x10d1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.00402040
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403925
mov esp, ebp
pop ebp
ret