Function at 0x1400062a0
Capabilities:
Create http request
Enumerate processes
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1550]
mov eax, 0x1650
call fcn.140010b30
sub rsp, rax
mov rax, qword [0x1400420c0]
xor rax, rsp
mov qword [rbp + 0x1540], rax
mov rdi, rcx
mov qword [rbp - 0x78], rcx
xor ebx, ebx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x140006323
lea r9, [0x14003afd0]
xor r8d, r8d
mov edx, 0xc
mov rcx, qword [0x140044e18]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400069d9
mov dword [rbp + 0x80], 0x238
lea rdx, [rbp + 0x80]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400069d0
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140006352
mov rdx, qword [rdi]
lea rcx, [rbp + 0xac]
call fcn.140015d9c
test eax, eax
jne 0x14000639e
mov r8d, dword [rbp + 0x88]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov qword [rbp - 0x80], rax
test rax, rax
jne 0x1400063b7
lea r9, str.Nepoda
xor r8d, r8d
mov edx, 0xc
mov rcx, qword [0x140044e18]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rbp + 0x80]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006345
jmp 0x1400069d0
lea rcx, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xorps xmm0, xmm0
movups xmmword [rbp + 0x300], xmm0
mov qword [rbp + 0x310], rbx
mov qword [rbp + 0x318], 0xf
mov byte [rbp + 0x300], bl
mov r14, qword [rbp + 0x50]
mov qword [rsp + 0x50], r14
cmp r14, qword [rbp + 0x58]
jae 0x140006d96
movabs r15, 0x7fffffffffffffff
movabs r13, 0x8000000000000000
mov r12d, 0x16
mov r9d, 0x30
lea r8, [rbp + 0x18]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x140006711
cmp dword [rbp + 0x38], 0x1000
jne 0x1400066fe
test byte [rbp + 0x3c], 4
je 0x1400066fe
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x1000
lea r8, [rbp + 0x540]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400066fe
lea rsi, [rbp + 0x540]
add rsi, qword [rbp + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c0], xmm0
lea rax, [rbp + 0x540]
mov qword [rbp + 0x2d0], rbx
cmp rax, rsi
jne 0x1400064b4
mov rax, rbx
mov r13d, 0xf
mov qword [rbp + 0x2d8], r13
mov byte [rbp + 0x2c0], 0
jmp 0x1400065b3
lea rax, [rbp + 0x540]
sub rsi, rax
mov edi, 0xf
mov qword [rbp + 0x2d8], rdi
cmp rsi, r15
ja 0x140006f0b
cmp rsi, rdi
jbe 0x140006570
mov rdi, rsi
or rdi, 0xf
cmp rdi, r15
jbe 0x1400064f1
mov rdi, r15
lea rax, [r13 + 0x27]
jmp 0x14000652b
cmp rdi, 0x16
cmovb rdi, r12
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140006515
mov rax, rbx
mov qword [rbp + 0x2c0], rbx
mov qword [rbp + 0x2d8], rdi
jmp 0x140006577
cmp rcx, 0x1000
jb 0x14000655b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006ed5
mov rcx, rax
call fcn.140010438
mov rcx, rax
test rax, rax
je 0x140006f05
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2d8], rdi
jmp 0x140006577
call fcn.140010438
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2d8], rdi
jmp 0x140006577
mov rax, qword [rbp + 0x2c0]
lea rbx, [rbp + 0x2c0]
cmp rdi, 0xf
cmova rbx, rax
mov r8, rsi
lea rdx, [rbp + 0x540]
mov rcx, rbx
call fcn.14002bee0
mov qword [rbp + 0x2d0], rsi
mov byte [rbx + rsi], 0
mov r13, qword [rbp + 0x2d8]
mov rax, qword [rbp + 0x2d0]
xor ebx, ebx
mov qword [rsp + 0x40], r13
mov rdi, qword [0x140044e38]
mov r12, qword [rbp + 0x2c0]
mov qword [rsp + 0x48], r12
cmp rdi, qword [0x140044e40]
je 0x1400066b2
nop dword [rax + rax]
mov rsi, qword [rdi + 0x10]
mov r14, rdi
mov rcx, qword [rdi + 0x18]
cmp rcx, 0xf
jbe 0x1400065f4
mov r14, qword [rdi]
lea r15, [rbp + 0x2c0]
cmp r13, 0xf
cmova r15, r12
cmp rsi, rax
ja 0x140006690
sub rax, rsi
test rsi, rsi
je 0x140006a33
lea r12, [r15 + rax]
movsx r13d, byte [r14]
lea r8, [r12 + 1]
sub r8, r15
mov edx, r13d
mov rcx, r15
call fcn.14002c920
mov rbx, rax
test rax, rax
je 0x14000667f
nop dword [rax + rax]
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.14002c9c0
test eax, eax
je 0x140006672
inc rbx
lea r8, [r12 + 1]
sub r8, rbx
mov edx, r13d
mov rcx, rbx
call fcn.14002c920
mov rbx, rax
test rax, rax
jne 0x140006640
jmp 0x14000667f
sub rbx, r15
cmp rbx, 0xffffffffffffffff
jne 0x140006a09
mov rax, qword [rbp + 0x2d0]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
add rdi, 0x20
cmp rdi, qword [0x140044e40]
jne 0x1400065e0
xor ebx, ebx
movabs r15, 0x7fffffffffffffff
mov r14, qword [rsp + 0x50]
cmp r13, 0xf
jbe 0x1400066ea
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x1400066e2
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f05
mov rcx, r12
call fcn.140010190
mov r12d, 0x16
movabs r13, 0x8000000000000000
mov rsi, qword [rbp - 0x80]
add r14, qword [rbp + 0x30]
mov qword [rsp + 0x50], r14
cmp r14, qword [rbp + 0x58]
jb 0x140006410
cmp qword [rbp + 0x310], 0
je 0x140006d8d
lea r8, [rbp + 0x300]
cmp qword [rbp + 0x318], 0xf
cmova r8, qword [rbp + 0x300]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor edx, edx
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14000d1f0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rdx, qword [rsp + 0x58]
lea r8, [rbp + 0x300]
cmp qword [rbp + 0x318], 0xf
cmova r8, qword [rbp + 0x300]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
xor edx, edx
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
mov r8, qword [rbp - 0x78]
lea rdx, str.Detekce_v_procesu
lea rcx, [rbp - 0x50]
call fcn.14000cea0
nop
mov r8d, 2
lea rdx, [0x14003b0d8]
mov rcx, rax
call fcn.14000a7d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea r9, [rsp + 0x58]
lea r8, [rbp - 0x70]
lea rcx, [rbp + 0x320]
call fcn.14000e430
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14000685d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006857
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ecf
call fcn.140010190
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14000689d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006898
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f11
call fcn.140010190
movdqa xmm0, xmmword [0x14003bf10]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r14w
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x1400068f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f17
call fcn.140010190
movdqa xmm0, xmmword [0x14003bf10]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r14w
cmp dword [0x140044e08], 1
jne 0x14000693a
lea r9, [rbp + 0x320]
cmp qword [rbp + 0x338], 7
cmova r9, qword [rbp + 0x320]
xor r8d, r8d
mov edx, 0xc
mov rcx, qword [0x140044e18]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rbp + 0x338]
cmp rdx, 7
jbe 0x140006980
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x320]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000697b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f1d
call fcn.140010190
mov r15, qword [rsp + 0x78]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x318]
cmp rdx, 0xf
jbe 0x1400069d0
inc rdx
mov rcx, qword [rbp + 0x300]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f23
call fcn.140010190
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1540]
xor rcx, rsp
call fcn.140010170
lea r11, [rsp + 0x1650]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movabs r15, 0x7fffffffffffffff
mov rax, r15
sub rax, rsi
cmp rax, 0x24
jb 0x140006edb
mov rcx, qword [rdi + 0x18]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
jmp 0x140006a3d
movabs r15, 0x7fffffffffffffff
mov rax, rdi
cmp rcx, 0xf
jbe 0x140006a49
mov rax, qword [rdi]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x24
lea r9, str.Detekce:_Nalezen_podez
lea rcx, [rbp - 0x10]
call fcn.14000e640
nop
mov r8d, 2
lea rdx, [0x14003b080]
lea rcx, [rbp - 0x10]
call fcn.14000bcd0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea rdx, [rbp - 0x70]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0x300]
call fcn.14000bcd0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140006b11
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ee1
call fcn.140010190
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140006b4c
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ee7
call fcn.140010190
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e0], xmm0
mov qword [rbp + 0x2f0], r14
mov qword [rbp + 0x2f8], r14
mov r8d, 0xc
lea rdx, str.DetectString
lea rcx, [rbp + 0x2e0]
call fcn.140003050
nop
lea rcx, [rbp + 0x320]
call fcn.140003b40
mov rbx, rax
mov rax, qword [rdi + 0x10]
mov rcx, r15
sub rcx, rax
cmp rcx, 0x17
jb 0x140006eff
cmp qword [rdi + 0x18], 0xf
jbe 0x140006bab
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0x17
lea r9, str.Detekce_cheat_stringu:
lea rcx, [rsp + 0x58]
call fcn.14000e640
lea rax, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 0xf
cmova rax, qword [rbp + 0x2e0]
cmp qword [rbx + 0x18], 0xf
jbe 0x140006bf0
mov rbx, qword [rbx]
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova r9, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r8, str.https:__zoofxpawn.hys.cz_AC_SCAN_Detections_detekce.php_text_sip_styp_s
mov edx, 0x200
lea rcx, [rbp + 0x340]
call fcn.140002130
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.DataSender
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
jne 0x140006c5e
lea rdx, str.Chyba_pri_inicializaci_WinINet
mov rcx, qword [0x140044e18]
call qword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x140006c98
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x340]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
test rax, rax
je 0x140006c8f
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140006cd5
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006cd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006eed
call fcn.140010190
xor ebx, ebx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], bl
mov rdx, qword [rbp + 0x338]
cmp rdx, 0xf
jbe 0x140006d2a
inc rdx
mov rcx, qword [rbp + 0x320]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ef3
call fcn.140010190
mov qword [rbp + 0x330], rbx
mov qword [rbp + 0x338], 0xf
mov byte [rbp + 0x320], 0
mov rdx, qword [rbp + 0x2f8]
cmp rdx, 0xf
jbe 0x1400066ad
inc rdx
mov rcx, qword [rbp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ef9
call fcn.140010190
jmp 0x1400066ad
mov rdi, qword [rbp - 0x78]
mov r15, qword [rsp + 0x78]
mov r8, rdi
lea rdx, [0x14003b110]
lea rcx, [rbp - 0x30]
call fcn.14000cea0
nop
mov r8d, 1
lea rdx, [0x14003b108]
mov rcx, rax
call fcn.14000a7d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2f0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2f0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x140006e38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f29
call fcn.140010190
movdqa xmm0, xmmword [0x14003bf10]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], bx
cmp dword [0x140044e08], 1
jne 0x140006e7e
lea r9, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 7
cmova r9, qword [rbp + 0x2e0]
xor r8d, r8d
mov edx, 0xc
mov rcx, qword [0x140044e18]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rbp + 0x2f8]
cmp rdx, 7
jbe 0x140006985
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ebf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ec9
call fcn.140010190
jmp 0x140006985
call fcn.14001929c
nop
call fcn.14001929c
nop
call fcn.140002290
nop
call fcn.140002330
nop
call fcn.14001929c
nop
call fcn.14001929c
nop
call fcn.14001929c
nop
call fcn.14001929c
nop
call fcn.14001929c
nop
call fcn.140002330
nop
call fcn.14001929c
int3
call fcn.140002330
nop
call fcn.14001929c
nop
call fcn.14001929c
int3
call fcn.14001929c
nop
call fcn.14001929c
nop
call fcn.14001929c
int3