Function at 0x180009870
Capabilities:
Enumerate files on windows
Enumerate threads
Get common file path
Get disk information
Get disk size
Get graphical window text
Get memory capacity
Get startup folder
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x348]
sub rsp, 0x420
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x180053028]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
mov r15, rcx
mov qword [rsp + 0x30], rcx
lea rcx, str.Product_of__d_and__d_is:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800098e1
mov edx, 5
lea r9d, [rdx + 0x19]
lea r8d, [rdx + 1]
lea rcx, str.Product_of__d_and__d_is:__d_n
call fcn.180001120
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov bl, 0x41
nop dword [rax + rax]
test dil, 1
je 0x18000999d
mov byte [rsp + 0x38], bl
mov word [rsp + 0x39], 0x5c3a
mov byte [rsp + 0x3b], 0
lea r9, [rbp - 0x78]
lea r8, [rbp - 0x80]
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x180009991
lea rcx, str.Disk_Drive__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009945
lea rdx, [rsp + 0x38]
lea rcx, str.Disk_Drive__s_n
call fcn.180001120
lea rcx, str.__Total_Space:__llu_GB_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000996a
mov rdx, qword [rbp - 0x80]
shr rdx, 0x1e
lea rcx, str.__Total_Space:__llu_GB_n
call fcn.180001120
lea rcx, str.__Free_Space:__llu_GB_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000999d
mov rdx, qword [rbp - 0x78]
shr rdx, 0x1e
lea rcx, str.__Free_Space:__llu_GB_n
call fcn.180001120
jmp 0x18000999d
lea rcx, str.Error_getting_disk_drive_information
call fcn.18001db60
shr edi, 1
inc bl
cmp bl, 0x5a
jle 0x1800098f0
xor r9d, r9d
lea r8d, [r9 + 7]
lea rdx, [rbp + 0xd0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x180009a46
lea r8, [rbp + 0xd0]
lea rdx, str._s
lea rcx, [rbp + 0x1e0]
call fcn.180001180
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180009a3d
nop dword [rax]
lea rcx, str.Startup_Item:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009a21
lea rdx, [rbp - 0x44]
lea rcx, str.Startup_Item:__s_n
call fcn.180001120
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180009a00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x180009a52
lea rcx, str.Error_finding_startup_items
jmp 0x180009a4d
lea rcx, str.Error_getting_startup_directory
call fcn.18001db60
xor r13d, r13d
mov r12d, r13d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
movabs rax, 0x8daea1d7f4cf721b
mul rbx
mov rsi, rbx
sub rsi, rdx
shr rsi, 1
add rsi, rdx
shr rsi, 0x1a
imul rax, rsi, 0x5265c00
mov rcx, rbx
sub rcx, rax
movabs r8, 0x4a90be587de6e565
mov rax, r8
mul rcx
mov r14, rdx
shr r14, 0x14
mov rax, r8
mul rbx
shr rdx, 0x14
imul rax, rdx, 0x36ee80
mov rdi, rbx
sub rdi, rax
movabs rcx, 0x179ec9cbd821dc3b
mov rax, rcx
mul rdi
sub rdi, rdx
shr rdi, 1
add rdi, rdx
shr rdi, 0xf
mov rax, rcx
mul rbx
mov rax, rbx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0xf
imul rax, rax, 0xea60
sub rbx, rax
movabs rax, 0x624dd2f1a9fbe77
mul rbx
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 9
lea rcx, str.System_Uptime:__d_days___d_hours___d_minutes___d_seconds_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009b39
mov dword [rsp + 0x20], ebx
mov r9d, edi
mov r8d, r14d
mov edx, esi
lea rcx, str.System_Uptime:__d_days___d_hours___d_minutes___d_seconds_n
call fcn.180001120
mov ebx, r13d
mov dword [rsp + 0x38], 8
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x180009b6b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rsp + 0x3c]
mov eax, 0x10624dd3
mul ecx
mov ebx, edx
shr ebx, 6
lea rcx, str.Idle_Time:__d_seconds_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009b8a
mov edx, ebx
lea rcx, str.Idle_Time:__d_seconds_n
call fcn.180001120
mov ebx, r13d
nop dword [rax]
lea rcx, str._d:__c_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009bb2
mov r8d, ebx
mov edx, ebx
lea rcx, str._d:__c_n
call fcn.180001120
inc ebx
cmp ebx, 0x80
jl 0x180009b90
mov dword [rsp + 0x40], 0x40
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x180009c04
lea rcx, str.Memory_Usage:__d_MB_Total___d_MB_Available_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009c21
mov r8, qword [rsp + 0x50]
shr r8, 0x14
mov rdx, qword [rsp + 0x48]
shr rdx, 0x14
lea rcx, str.Memory_Usage:__d_MB_Total___d_MB_Available_n
call fcn.180001120
jmp 0x180009c21
lea rcx, str.Failed_to_get_memory_usage__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009c21
lea rcx, str.Failed_to_get_memory_usage__n
call fcn.180001120
cmp qword [r15 + 0x18], 0x10
jb 0x180009c33
mov rcx, qword [r15]
mov rdx, rcx
mov rdi, rcx
jmp 0x180009c3c
mov rdi, r15
mov rdx, r15
mov rcx, r15
mov rsi, qword [r15 + 0x10]
add rsi, rdx
cmp rcx, rsi
je 0x180009ed1
movsd xmm6, qword [0x18004d210]
movsd xmm7, qword [0x18004d270]
nop dword [rax]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
movzx r8d, byte [rdi]
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.180014820
lea rcx, str.Remainder_of__d_and__d_is:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009cb0
mov edx, 0x11
lea r9d, [rdx - 0x10]
lea r8d, [rdx - 0xd]
lea rcx, str.Remainder_of__d_and__d_is:__d_n
call fcn.180001120
lea rcx, str.The_value_of_Eulers_number_e_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009cdd
movaps xmm0, xmm6
call fcn.180039fa0
movaps xmm1, xmm0
movq rdx, xmm0
lea rcx, str.The_value_of_Eulers_number_e_is:__lf_n
call fcn.180001120
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTopWindow]
mov rbx, rax
test rax, rax
je 0x180009d40
nop dword [rax]
mov r8d, 0x100
lea rdx, [rbp + 0xd0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rcx, str.Window_Title:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009d2a
lea rdx, [rbp + 0xd0]
lea rcx, str.Window_Title:__s_n
call fcn.180001120
mov edx, 2
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindow]
mov rbx, rax
test rax, rax
jne 0x180009cf0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.Difference_of__d_and__d_is:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009d82
mov edx, 0x1e
mov r9d, reloc.WS2_32.dll_ntohs
mov r8d, r9d
lea rcx, str.Difference_of__d_and__d_is:__d_n
call fcn.180001120
lea rcx, str.The_10th_Fibonacci_number_is:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009da4
mov edx, 0x37
lea rcx, str.The_10th_Fibonacci_number_is:__d_n
call fcn.180001120
lea rcx, str.Hexadecimal_integer:_0x_X_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009dc6
mov edx, 0xabcd
lea rcx, str.Hexadecimal_integer:_0x_X_n
call fcn.180001120
mov eax, r12d
inc r12d
cmp eax, 0x2710
jg 0x180009e94
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.Current_date:_2024_04_07_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009dff
lea rcx, str.Current_date:_2024_04_07_n
call fcn.180001120
lea rcx, str.The_natural_logarithm_of_10_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009e2c
movaps xmm0, xmm7
call fcn.18003a3a0
movaps xmm1, xmm0
movq rdx, xmm0
lea rcx, str.The_natural_logarithm_of_10_is:__lf_n
call fcn.180001120
lea rcx, str.Hello__world__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009e49
lea rcx, str.Hello__world__n
call fcn.180001120
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180009e86
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009e81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a070
call fcn.180018cc0
inc rdi
cmp rdi, rsi
jne 0x180009c60
jmp 0x180009ed1
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180009ed1
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009ecc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a070
call fcn.180018cc0
lea rcx, str.Boolean:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009ef3
mov edx, 1
lea rcx, str.Boolean:__d_n
call fcn.180001120
lea rcx, str.Null_pointer:__p_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009f12
xor edx, edx
lea rcx, str.Null_pointer:__p_n
call fcn.180001120
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180009f37
lea rcx, str.Error_creating_thread_snapshot
call fcn.18001db60
jmp 0x180009fcd
mov dword [rsp + 0x40], 0x1c
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x180009f70
lea rcx, str.Error_getting_first_thread
call fcn.18001db60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
lea rcx, str.Thread_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009f91
mov edx, dword [rsp + 0x48]
lea rcx, str.Thread_ID:__lu_n
call fcn.180001120
lea rcx, str.Owner_Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009fb2
mov edx, dword [rsp + 0x4c]
lea rcx, str.Owner_Process_ID:__lu_n
call fcn.180001120
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180009f70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str._c_is_a_punctuation_mark._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009ff0
mov edx, 0x2c
lea rcx, str._c_is_a_punctuation_mark._n
call fcn.180001120
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x18000a026
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x18000a021
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000a076
mov rcx, r8
call fcn.180018cc0
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r15], 0
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.180018ca0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18001e488
nop
call fcn.18001e488
int3