Function at 0x1800065f0
Capabilities:
Access the windows event log
Encrypt or decrypt via wincrypt
Enumerate files on windows
Enumerate services
Get common file path
Get graphical window text
Get mac address on windows
Get startup folder
Persist via run registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc1e8]
mov eax, 0xc2e8
call fcn.1800197c0
sub rsp, rax
mov rax, qword [0x180053028]
xor rax, rsp
mov qword [rbp + 0xc1d0], rax
mov rax, qword [rbp + 0xc250]
mov r12, r9
mov qword [rsp + 0x40], rcx
mov r15, rdx
lea rcx, str.String:_This_is_a_string_n
mov qword [rsp + 0x68], rax
mov r13d, r8d
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000665a
lea rcx, str.String:_This_is_a_string_n
call fcn.180001120
lea rcx, str.Difference_of__d_and__d_is:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006685
mov r9d, reloc.WS2_32.dll_ntohs
lea rcx, str.Difference_of__d_and__d_is:__d_n
mov r8d, r9d
mov edx, 0x1e
call fcn.180001120
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
test rax, rax
je 0x180006700
nop dword [rax]
nop word [rax + rax]
mov r8d, 0x100
lea rdx, [rbp + 0xbfb0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rcx, str.Window_Title:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800066ea
lea rdx, [rbp + 0xbfb0]
lea rcx, str.Window_Title:__s_n
call fcn.180001120
mov edx, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
test rax, rax
jne 0x1800066b0
lea rdx, str.Security
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x18000689d
mov ecx, 0x10000
call fcn.180020ffc
mov rdi, rax
test rax, rax
je 0x180006886
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea edx, [r14 + 5]
mov r9, rdi
mov dword [rsp + 0x20], 0x10000
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
je 0x180006873
nop word [rax + rax]
lea rcx, str.Event_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006790
mov edx, dword [rdi + 0x14]
lea rcx, str.Event_ID:__lu_n
call fcn.180001120
lea rcx, str.Event_Type:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800067b1
movzx edx, word [rdi + 0x18]
lea rcx, str.Event_Type:__lu_n
call fcn.180001120
lea rcx, str.Event_Category:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800067d2
movzx edx, word [rdi + 0x1c]
lea rcx, str.Event_Category:__lu_n
call fcn.180001120
lea rcx, str.Time_Generated:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800067fb
lea rcx, [rdi + 0xc]
call fcn.180020f88
mov rdx, rax
lea rcx, str.Time_Generated:__s_n
call fcn.180001120
lea rcx, str.Source_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000681e
mov edx, dword [rdi + 0x24]
lea rcx, str.Source_Name:__s_n
add rdx, rdi
call fcn.180001120
lea rcx, str.Event_String:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006841
mov edx, dword [rdi + 0x34]
lea rcx, str.Event_String:__s_n
add rdx, rdi
call fcn.180001120
xor r8d, r8d
mov qword [rsp + 0x30], r14
lea rax, [rsp + 0x58]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov dword [rsp + 0x20], 0x10000
lea edx, [r8 + 5]
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
jne 0x180006770
mov rcx, rdi
call fcn.180020c30
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x1800068a9
lea rcx, str.Error_allocating_memory_for_event_log_record
call fcn.18001db60
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x1800068a9
lea rcx, str.Error_opening_event_log
call fcn.18001db60
lea rcx, str.Hexadecimal_integer:_0x_X_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800068cb
mov edx, 0xabcd
lea rcx, str.Hexadecimal_integer:_0x_X_n
call fcn.180001120
xor edx, edx
mov dword [rsp + 0x5c], r14d
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
jne 0x1800068f9
lea rcx, str.Error_opening_service_control_manager
call fcn.18001db60
jmp 0x180006a19
lea rax, [rsp + 0x5c]
mov edx, 0x30
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x80]
lea rax, [rsp + 0x58]
mov rcx, rsi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea r8d, [rdx - 0x2d]
mov dword [rsp + 0x20], 0xc000
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x180006952
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x180006952
lea rcx, str.Error_enumerating_services
call fcn.18001db60
mov ebx, r14d
cmp dword [rsp + 0x58], ebx
jbe 0x180006a10
nop
lea rcx, str.Service_Name:__s_n
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000698b
lea rdx, [rdi + rdi*2]
add rdx, rdx
lea rcx, str.Service_Name:__s_n
mov rdx, qword [rbp + rdx*8 - 0x80]
call fcn.180001120
lea rcx, str.Display_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800069b4
lea rdx, [rdi + rdi*2]
add rdx, rdx
lea rcx, str.Display_Name:__s_n
mov rdx, qword [rbp + rdx*8 - 0x78]
call fcn.180001120
lea rcx, str.Service_Type:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800069dc
lea rax, [rdi + rdi*2]
add rax, rax
lea rcx, str.Service_Type:__lu_n
mov edx, dword [rbp + rax*8 - 0x70]
call fcn.180001120
lea rcx, str.Service_State:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006a04
lea rax, [rdi + rdi*2]
add rax, rax
lea rcx, str.Service_State:__lu_n
mov edx, dword [rbp + rax*8 - 0x6c]
call fcn.180001120
inc ebx
cmp ebx, dword [rsp + 0x58]
jb 0x180006960
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.String:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006a3d
lea rdx, str.This_is_a_string
lea rcx, str.String:__s_n
call fcn.180001120
lea rcx, str.Unsigned_long_integer:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006a5f
mov edx, 0xffffffff
lea rcx, str.Unsigned_long_integer:__lu_n
call fcn.180001120
lea rcx, str.Hexadecimal_integer:_0x_X_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006a81
mov edx, 0xabcd
lea rcx, str.Hexadecimal_integer:_0x_X_n
call fcn.180001120
mov rcx, r13
call fcn.180020ffc
mov qword [r12], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180006b31
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0xbfb0]
mov r9d, 0x100
xor edx, edx
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x180006b24
nop dword [rax + rax]
lea rcx, str.Startup_Item:__s_n
inc edi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006b06
lea rdx, [rbp + 0xbfb0]
lea rcx, str.Startup_Item:__s_n
call fcn.180001120
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0xbfb0]
mov r9d, 0x100
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x180006ae0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180006b3d
lea rcx, str.Error_opening_registry_key
call fcn.18001db60
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x180006b6c
mov ecx, eax
movzx r8d, al
shr ecx, 8
lea rdx, str.Windows_NT__d._d
movzx r9d, cl
lea rcx, [rbp + 0xbfb0]
call fcn.180001180
jmp 0x180006b9c
jne 0x180006b8b
movups xmm0, xmmword [str.Windows_95_98_Me]
movzx eax, byte [0x18004c968]
mov byte [rbp + 0xbfc0], al
movaps xmmword [rbp + 0xbfb0], xmm0
jmp 0x180006b9c
movabs rax, 0x6e776f6e6b6e55
mov qword [rbp + 0xbfb0], rax
lea rcx, str.Operating_System_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006bc0
lea rdx, [rbp + 0xbfb0]
lea rcx, str.Operating_System_Name:__s_n
call fcn.180001120
lea rcx, str.Square_root_of__.2f:__.2f_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006c17
movss xmm1, dword [0x18004d288]
xorps xmm0, xmm0
ucomiss xmm0, xmm1
ja 0x180006bea
xorps xmm0, xmm0
sqrtss xmm0, xmm1
jmp 0x180006bf2
movaps xmm0, xmm1
call fcn.18003af10
movsd xmm1, qword [0x18004d280]
lea rcx, str.Square_root_of__.2f:__.2f_n
xorps xmm2, xmm2
movq rdx, xmm1
cvtss2sd xmm2, xmm0
movq r8, xmm2
call fcn.180001120
mov rdi, qword [r12]
test rdi, rdi
je 0x1800076af
xor eax, eax
mov dword [rsp + 0x5c], 0x2c0
mov rcx, r13
rep stosb byte [rdi], al
mov ecx, 0x2c0
call fcn.180020ffc
lea rdi, [0x18004c674]
mov rsi, rax
test rax, rax
jne 0x180006c5d
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersInfo
call fcn.18001db60
jmp 0x180006e21
lea rdx, [rsp + 0x5c]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x180006c95
mov rcx, rsi
call fcn.180020c30
mov ecx, dword [rsp + 0x5c]
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x180006c95
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersInfo
call fcn.18001db60
lea rdx, [rsp + 0x5c]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x180006e08
mov rbx, rsi
test rsi, rsi
je 0x180006e21
nop word [rax + rax]
lea rcx, str.Adapter_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006ce1
lea rdx, [rbx + 0xc]
lea rcx, str.Adapter_Name:__s_n
call fcn.180001120
lea rcx, str.Adapter_Description:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006d05
lea rdx, [rbx + 0x110]
lea rcx, str.Adapter_Description:__s_n
call fcn.180001120
lea rcx, str.Adapter_Address:__02X__02X__02X__02X__02X__02X_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006d61
movzx ecx, byte [rbx + 0x19c]
movzx eax, byte [rbx + 0x19d]
movzx edi, byte [rbx + 0x19b]
movzx r9d, byte [rbx + 0x19a]
movzx r8d, byte [rbx + 0x199]
movzx edx, byte [rbx + 0x198]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rcx, str.Adapter_Address:__02X__02X__02X__02X__02X__02X_n
mov dword [rsp + 0x20], edi
call fcn.180001120
lea rdi, [0x18004c674]
lea rcx, str.Adapter_Index:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006d84
mov edx, dword [rbx + 0x1a0]
lea rcx, str.Adapter_Index:__u_n
call fcn.180001120
lea rcx, str.Type:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006da7
mov edx, dword [rbx + 0x1a4]
lea rcx, str.Type:__u_n
call fcn.180001120
lea rcx, str.DHCP_Enabled:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006dd6
cmp dword [rbx + 0x1a8], r14d
lea rdx, [0x18004c678]
lea rcx, str.DHCP_Enabled:__s_n
cmovne rdx, rdi
call fcn.180001120
lea rcx, str.DHCP_Server:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006dfa
lea rdx, [rbx + 0x220]
lea rcx, str.DHCP_Server:__s_n
call fcn.180001120
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180006cc0
jmp 0x180006e19
lea rcx, str.GetAdaptersInfo_failed_with_error
call fcn.18001db60
test rsi, rsi
je 0x180006e21
mov rcx, rsi
call fcn.180020c30
lea rcx, str.Current_date:_2024_04_07_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006e3e
lea rcx, str.Current_date:_2024_04_07_n
call fcn.180001120
xorps xmm0, xmm0
mov dword [rbp + 0xbfb0], 0x9c
xor eax, eax
lea rcx, [rbp + 0xbfb0]
movups xmmword [rbp + 0xbfb4], xmm0
mov qword [rbp + 0xc044], rax
movups xmmword [rbp + 0xbfc4], xmm0
movups xmmword [rbp + 0xbfd4], xmm0
movups xmmword [rbp + 0xbfe4], xmm0
movups xmmword [rbp + 0xbff4], xmm0
movups xmmword [rbp + 0xc004], xmm0
movups xmmword [rbp + 0xc014], xmm0
movups xmmword [rbp + 0xc024], xmm0
movups xmmword [rbp + 0xc034], xmm0
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x180006ee3
lea rcx, str.Operating_System_Version:__d._d._d__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006eef
mov r9d, dword [rbp + 0xbfbc]
lea rax, [rbp + 0xbfc4]
mov r8d, dword [rbp + 0xbfb8]
lea rcx, str.Operating_System_Version:__d._d._d__s_n
mov edx, dword [rbp + 0xbfb4]
mov qword [rsp + 0x20], rax
call fcn.180001120
jmp 0x180006eef
lea rcx, str.Error_getting_OS_version
call fcn.18001db60
mov rcx, qword [r12]
test r13d, r13d
je 0x180006f26
test rcx, rcx
je 0x180006f16
mov r8, r13
test r15, r15
je 0x180006f0f
mov rdx, r15
call fcn.18001a740
jmp 0x180006f26
xor edx, edx
call fcn.18001adf0
call fcn.180020694
mov dword [rax], 0x16
call fcn.18001e468
lea rcx, str.Factorial_of__d_is__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180006f4e
mov edx, 6
lea rcx, str.Factorial_of__d_is__d_n
mov r8d, 0x2d0
call fcn.180001120
mov ecx, 0x2c0
mov dword [rsp + 0x58], 0x2c0
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x180006f79
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersInfo
call fcn.18001db60
jmp 0x18000713a
lea rdx, [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x180006fb1
mov rcx, rsi
call fcn.180020c30
mov ecx, dword [rsp + 0x58]
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x180006fb1
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersInfo
call fcn.18001db60
lea rdx, [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x180007121
mov rbx, rsi
test rsi, rsi
je 0x18000713a
lea r14, [0x18004c674]
nop word [rax + rax]
lea rcx, str.Adapter_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007001
lea rdx, [rbx + 0xc]
lea rcx, str.Adapter_Name:__s_n
call fcn.180001120
lea rcx, str.Adapter_Description:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007025
lea rdx, [rbx + 0x110]
lea rcx, str.Adapter_Description:__s_n
call fcn.180001120
lea rcx, str.Adapter_Address:__02X__02X__02X__02X__02X__02X_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000707a
movzx ecx, byte [rbx + 0x19c]
movzx eax, byte [rbx + 0x19d]
movzx edi, byte [rbx + 0x19b]
movzx r9d, byte [rbx + 0x19a]
movzx r8d, byte [rbx + 0x199]
movzx edx, byte [rbx + 0x198]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rcx, str.Adapter_Address:__02X__02X__02X__02X__02X__02X_n
mov dword [rsp + 0x20], edi
call fcn.180001120
lea rcx, str.Adapter_Index:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000709d
mov edx, dword [rbx + 0x1a0]
lea rcx, str.Adapter_Index:__u_n
call fcn.180001120
lea rcx, str.Type:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800070c0
mov edx, dword [rbx + 0x1a4]
lea rcx, str.Type:__u_n
call fcn.180001120
lea rcx, str.DHCP_Enabled:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800070ef
cmp dword [rbx + 0x1a8], 0
lea rdx, [0x18004c678]
lea rcx, str.DHCP_Enabled:__s_n
cmovne rdx, r14
call fcn.180001120
lea rcx, str.DHCP_Server:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007113
lea rdx, [rbx + 0x220]
lea rcx, str.DHCP_Server:__s_n
call fcn.180001120
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180006fe0
jmp 0x180007132
lea rcx, str.GetAdaptersInfo_failed_with_error
call fcn.18001db60
test rsi, rsi
je 0x18000713a
mov rcx, rsi
call fcn.180020c30
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800071ef
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rbp + 0xbf80]
mov dword [rsp + 0x64], 0x14
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.InstallDate
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800071d6
lea rcx, str.Operating_System_Install_Date:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800071e2
lea rdx, [rbp + 0xbf80]
lea rcx, str.Operating_System_Install_Date:__s_n
call fcn.180001120
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1800071fb
lea rcx, str.Error_getting_OS_install_date
call fcn.18001db60
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1800071fb
lea rcx, str.Error_opening_registry_key
call fcn.18001db60
lea rcx, str.The_maximum_number_between__d_and__d_is__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007226
mov r9d, 0x14
lea rcx, str.The_maximum_number_between__d_and__d_is__d_n
mov r8d, r9d
mov edx, reloc.WS2_32.dll_ntohs
call fcn.180001120
lea rcx, str.Natural_Logarithm_of_10:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007258
movsd xmm0, qword [0x18004d270]
call fcn.18003a3a0
movaps xmm1, xmm0
lea rcx, str.Natural_Logarithm_of_10:__lf_n
movq rdx, xmm0
call fcn.180001120
xor r9d, r9d
lea rdx, [rbp + 0xbfb0]
xor ecx, ecx
lea r8d, [r9 + 7]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x1800072f6
lea r8, [rbp + 0xbfb0]
lea rdx, str._s
lea rcx, [rbp + 0xc0c0]
call fcn.180001180
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xc0c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800072ed
nop word [rax + rax]
lea rcx, str.Startup_Item:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800072d1
lea rdx, [rbp - 0x54]
lea rcx, str.Startup_Item:__s_n
call fcn.180001120
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1800072b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x180007302
lea rcx, str.Error_finding_startup_items
jmp 0x1800072fd
lea rcx, str.Error_getting_startup_directory
call fcn.18001db60
lea rcx, str.The_surface_area_of_the_sphere_with_radius__lf_is:__lf_n
mov dword [rsp + 0x60], r13d
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000733e
movsd xmm2, qword [0x18004d278]
lea rcx, str.The_surface_area_of_the_sphere_with_radius__lf_is:__lf_n
movsd xmm1, qword [0x18004d210]
movq r8, xmm2
movq rdx, xmm1
call fcn.180001120
lea rcx, str.Sine_Value:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007370
movsd xmm0, qword [0x18004d208]
call fcn.18003a8d0
movaps xmm1, xmm0
lea rcx, str.Sine_Value:__lf_n
movq rdx, xmm0
call fcn.180001120
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
test rax, rax
je 0x1800073e0
nop dword [rax]
mov r8d, 0x100
lea rdx, [rbp + 0xbfb0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rcx, str.Window_Title:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800073ca
lea rdx, [rbp + 0xbfb0]
lea rcx, str.Window_Title:__s_n
call fcn.180001120
mov edx, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
test rax, rax
jne 0x180007390
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov rax, qword [r12]
xor edx, edx
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1800076af
mov ebx, 0x64
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x51eb851f
mul ebx
mov eax, 0xcccccccd
mov r8d, edx
mul ebx
shr r8d, 5
mov eax, 0x66666667
mov edi, edx
shr edi, 3
imul edi
mov ecx, edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
mov edx, ebx
add eax, eax
sub ecx, eax
lea eax, [rdi + rdi*4]
add eax, eax
mov edi, ecx
sub edx, eax
imul edi, ecx
mov eax, r8d
imul eax, r8d
imul edi, ecx
imul eax, r8d
add edi, eax
mov eax, edx
imul eax, edx
imul eax, edx
add edi, eax
cmp ebx, edi
jne 0x18000749f
lea rcx, str.Narcissistic_Number:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000749f
mov edx, ebx
lea rcx, str.Narcissistic_Number:__d_n
call fcn.180001120
inc ebx
cmp ebx, 0x3e8
jl 0x180007420
lea rcx, str._c_is_a_punctuation_mark._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800074cf
mov edx, 0x2c
lea rcx, str._c_is_a_punctuation_mark._n
call fcn.180001120
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180007571
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0xbfb0]
mov r9d, 0x100
xor edx, edx
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x180007564
nop word [rax + rax]
lea rcx, str.Startup_Item:__s_n
inc edi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007546
lea rdx, [rbp + 0xbfb0]
lea rcx, str.Startup_Item:__s_n
call fcn.180001120
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0xbfb0]
mov r9d, 0x100
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x180007520
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18000757d
lea rcx, str.Error_opening_registry_key
call fcn.18001db60
mov rcx, qword [rsp + 0x68]
mov eax, dword [rsp + 0x60]
mov dword [rcx], eax
lea rcx, str.Quotient_of__d_and__d_is:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800075b2
mov edx, 0x64
lea rcx, str.Quotient_of__d_and__d_is:__d_n
lea r9d, [rdx - 0x4b]
lea r8d, [rdx - 0x60]
call fcn.180001120
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, str.Current_Time_2:__d__d__d__d:_d:_d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007608
movzx eax, word [rsp + 0x74]
lea rcx, str.Current_Time_2:__d__d__d__d:_d:_d_n
movzx edi, word [rsp + 0x72]
movzx r10d, word [rsp + 0x70]
movzx r9d, word [rsp + 0x6e]
movzx r8d, word [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r10d
call fcn.180001120
movdqa xmm0, xmmword [0x18004d2a0]
lea rcx, str.Array_elements:_n
movdqa xmm1, xmmword [0x18004d2b0]
movdqu xmmword [rbp + 0xbf80], xmm0
mov dword [rbp + 0xbfa0], 9
movdqu xmmword [rbp + 0xbf90], xmm1
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000764f
lea rcx, str.Array_elements:_n
call fcn.180001120
xor ebx, ebx
xor edi, edi
lea rcx, [0x18004c408]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000767b
lea rax, [rbx + rdi]
mov edx, dword [rbp + rax*4 + 0xbf80]
lea rcx, [0x18004c408]
call fcn.180001120
inc rdi
cmp rdi, 3
jl 0x180007653
lea rcx, [0x18004bd68]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800076a1
lea rcx, [0x18004bd68]
call fcn.180001120
add rbx, 3
cmp rbx, 9
jl 0x180007651
mov al, 1
jmp 0x1800076b1
xor al, al
mov rcx, qword [rbp + 0xc1d0]
xor rcx, rsp
call fcn.180018ca0
add rsp, 0xc2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret