Function at 0x401560
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x180
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], rcx
mov dword [rbp + 0x118], edx
mov qword [rbp + 0x120], r8
mov qword [rbp + 0x128], r9
cmp dword [rbp + 0x118], 0x111
je 0x40173a
cmp dword [rbp + 0x118], 0x111
ja 0x40187c
cmp dword [rbp + 0x118], 0x14
je 0x401801
cmp dword [rbp + 0x118], 0x14
ja 0x40187c
cmp dword [rbp + 0x118], 1
je 0x4015e0
cmp dword [rbp + 0x118], 2
je 0x4017ee
jmp 0x40187c
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0xc8
mov dword [rsp + 0x28], 0x14
mov dword [rsp + 0x20], 0x14
mov r9d, 0x50000000
lea r8, str.Enter_password:
lea rdx, str.STATIC
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CreateWindowExA]
call rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0xc8
mov dword [rsp + 0x28], 0x3c
mov dword [rsp + 0x20], 0x14
mov r9d, 0x50800020
lea r8, [0x00421018]
lea rdx, str.EDIT
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CreateWindowExA]
call rax
mov qword [0x0042c060], rax
mov rax, qword [0x0042c060]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetFocus]
call rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 1
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x32
mov dword [rsp + 0x28], 0x64
mov dword [rsp + 0x20], 0x50
mov r9d, 0x50000000
lea r8, [0x0042101e]
lea rdx, str.BUTTON
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CreateWindowExA]
call rax
jmp 0x4018ab
mov rax, qword [rbp + 0x120]
cmp ax, 1
jne 0x4018aa
mov rax, qword [0x0042c060]
lea rdx, [rbp - 0x20]
mov r8d, 0x100
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowTextA]
call rax
lea rax, [rbp - 0x20]
mov rdx, rax
lea rcx, [0x0042c040]
call method.bool_std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
test al, al
je 0x4017c5
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.cmd.exe
lea rdx, str.open
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_PostQuitMessage]
call rax
jmp 0x4018aa
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Incorrect_password
mov rcx, qword [rbp + 0x110]
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
jmp 0x4018aa
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_PostQuitMessage]
call rax
jmp 0x4018ab
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0xf8], rax
lea rax, [rbp + 0xe0]
mov rdx, rax
mov rcx, qword [rbp + 0x110]
mov rax, qword [sym.imp.USER32.dll_GetClientRect]
call rax
mov ecx, 0xb48246
mov rax, qword [sym.imp.GDI32.dll_CreateSolidBrush]
call rax
mov qword [rbp + 0xf0], rax
mov rcx, qword [rbp + 0xf0]
lea rdx, [rbp + 0xe0]
mov rax, qword [rbp + 0xf8]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_FillRect]
call rax
mov rax, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov eax, 1
jmp 0x4018b0
mov rcx, qword [rbp + 0x128]
mov rdx, qword [rbp + 0x120]
mov eax, dword [rbp + 0x118]
mov r9, rcx
mov r8, rdx
mov edx, eax
mov rcx, qword [rbp + 0x110]
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
call rax
jmp 0x4018b0
nop
mov eax, 0
add rsp, 0x180
pop rbp
ret