Function at 0x1800076e0
Capabilities:
Access the windows event log
Check for unmoving mouse cursor
Check os version
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Enumerate processes
Get disk information
Get disk size
Get graphical window text
Get hostname
Get installed programs
Get mac address on windows
Get memory capacity
Get system information on windows
List tcp connections and listeners
Log keystrokes via polling
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x368]
sub rsp, 0x428
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm10
mov rax, qword [0x180053028]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
mov qword [rsp + 0x78], r9
mov r13d, r8d
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rcx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x180007774
lea rcx, str.Mouse_Position:__ld___ld_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007780
mov r8d, dword [rbp + 0x1d4]
mov edx, dword [rbp + 0x1d0]
lea rcx, str.Mouse_Position:__ld___ld_n
call fcn.180001120
jmp 0x180007780
lea rcx, str.Error_getting_mouse_position
call fcn.18001db60
lea rcx, str.The_surface_area_of_the_sphere_with_radius__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsd xmm10, qword [0x18004d210]
test eax, eax
jns 0x1800077bc
movsd xmm2, qword [0x18004d278]
movq r8, xmm2
movaps xmm1, xmm10
movq rdx, xmm1
lea rcx, str.The_surface_area_of_the_sphere_with_radius__lf_is:__lf_n
call fcn.180001120
lea rcx, str.Product_of__.2f_and__.2f_is__.2f_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007800
movsd xmm3, qword [0x18004d268]
movq r9, xmm3
movsd xmm2, qword [0x18004d248]
movq r8, xmm2
movsd xmm1, qword [0x18004d220]
movq rdx, xmm1
lea rcx, str.Product_of__.2f_and__.2f_is__.2f_n
call fcn.180001120
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r14b
mov dword [rsp + 0x40], 1
lea rcx, str.Boolean_value:_true_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007837
lea rcx, str.Boolean_value:_true_n
call fcn.180001120
mov dword [rbp - 0x50], 0x40
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x18000787b
lea rcx, str.Memory_Usage:__d_MB_Total___d_MB_Available_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007898
mov r8, qword [rbp - 0x40]
shr r8, 0x14
mov rdx, qword [rbp - 0x48]
shr rdx, 0x14
lea rcx, str.Memory_Usage:__d_MB_Total___d_MB_Available_n
call fcn.180001120
jmp 0x180007898
lea rcx, str.Failed_to_get_memory_usage__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007898
lea rcx, str.Failed_to_get_memory_usage__n
call fcn.180001120
lea rcx, str.Mouse_Button_State:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800078d7
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
lea rax, str.Pressed
lea rdx, str.Released
cmovb rdx, rax
lea rcx, str.Mouse_Button_State:__s_n
call fcn.180001120
mov qword [rsp + 0x60], r14
lea rcx, str.Decimal_integer:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800078fe
mov edx, 0x3039
lea rcx, str.Decimal_integer:__d_n
call fcn.180001120
lea rdx, str.System
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov rdi, rax
test rax, rax
je 0x180007a92
mov ecx, 0x10000
call fcn.180020ffc
mov rbx, rax
test rax, rax
je 0x180007a7b
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, rbx
xor r8d, r8d
lea edx, [r8 + 5]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
je 0x180007a68
lea rcx, str.Event_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007983
mov edx, dword [rbx + 0x14]
lea rcx, str.Event_ID:__lu_n
call fcn.180001120
lea rcx, str.Event_Type:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800079a4
movzx edx, word [rbx + 0x18]
lea rcx, str.Event_Type:__lu_n
call fcn.180001120
lea rcx, str.Event_Category:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800079c5
movzx edx, word [rbx + 0x1c]
lea rcx, str.Event_Category:__lu_n
call fcn.180001120
lea rcx, str.Time_Generated:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800079ee
lea rcx, [rbx + 0xc]
call fcn.180020f88
mov rdx, rax
lea rcx, str.Time_Generated:__s_n
call fcn.180001120
lea rcx, str.Source_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007a11
mov edx, dword [rbx + 0x24]
add rdx, rbx
lea rcx, str.Source_Name:__s_n
call fcn.180001120
lea rcx, str.Event_String:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007a34
mov edx, dword [rbx + 0x34]
add rdx, rbx
lea rcx, str.Event_String:__s_n
call fcn.180001120
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, rbx
xor r8d, r8d
lea edx, [r8 + 5]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
jne 0x180007963
mov rcx, rbx
call fcn.180020c30
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x180007a9e
lea rcx, str.Error_allocating_memory_for_event_log_record
call fcn.18001db60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x180007a9e
lea rcx, str.Error_opening_event_log
call fcn.18001db60
lea rcx, str.Array_length:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007ac0
mov edx, 5
lea rcx, str.Array_length:__d_n
call fcn.180001120
mov dword [rsp + 0x58], r14d
lea rdx, [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x180007b4d
mov ecx, dword [rsp + 0x58]
call fcn.180020ffc
mov rdi, rax
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x180007b37
mov rbx, rdi
test rdi, rdi
je 0x180007b43
lea rcx, str.Network_Adapter:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007b25
lea rdx, [rbx + 0x110]
lea rcx, str.Network_Adapter:__s_n
call fcn.180001120
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180007b01
mov rcx, rdi
call fcn.180020c30
jmp 0x180007b59
lea rcx, str.Error_getting_network_adapters
call fcn.18001db60
mov rcx, rdi
call fcn.180020c30
jmp 0x180007b59
lea rcx, str.Error_getting_network_adapters
call fcn.18001db60
lea rcx, str.Character:__c_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007b7b
mov edx, 0x5a
lea rcx, str.Character:__c_n
call fcn.180001120
mov dword [rbp - 0x50], 0x40
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x180007bb7
lea rcx, str.Physical_Memory_Total:__llu_MB_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007bc3
mov rdx, qword [rbp - 0x48]
shr rdx, 0x14
lea rcx, str.Physical_Memory_Total:__llu_MB_n
call fcn.180001120
jmp 0x180007bc3
lea rcx, str.Error_getting_physical_memory
call fcn.18001db60
mov dword [rbp + 0x20], 0x1a8
mov ebx, r14d
xor r9d, r9d
lea r8, [rbp + 0x20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
je 0x180007ce5
mov edi, 0x9c
nop dword [rax + rax]
lea rcx, str.Display_Device:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007c11
lea rdx, [rbp + 0x24]
lea rcx, str.Display_Device:__s_n
call fcn.180001120
lea rcx, str.Display_Device_String:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007c32
lea rdx, [rbp + 0x44]
lea rcx, str.Display_Device_String:__s_n
call fcn.180001120
mov word [rbp + 0x214], di
lea r8, [rbp + 0x1f0]
mov edx, 0xffffffff
lea rcx, [rbp + 0x24]
call qword [sym.imp.USER32.dll_EnumDisplaySettingsA]
test eax, eax
je 0x180007ca7
lea rcx, str.Display_Settings:__d_x__d___d_bit_color_depth_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007c84
mov r9d, dword [rbp + 0x258]
mov r8d, dword [rbp + 0x260]
mov edx, dword [rbp + 0x25c]
lea rcx, str.Display_Settings:__d_x__d___d_bit_color_depth_n
call fcn.180001120
lea rcx, str.Display_Refresh_Rate:__d_Hz_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007ca7
mov edx, dword [rbp + 0x268]
lea rcx, str.Display_Refresh_Rate:__d_Hz_n
call fcn.180001120
lea rcx, str.Display_Device_State:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007cca
mov edx, dword [rbp + 0xc4]
lea rcx, str.Display_Device_State:__d_n
call fcn.180001120
inc ebx
xor r9d, r9d
lea r8, [rbp + 0x20]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
jne 0x180007bf0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTopWindow]
mov rbx, rax
test rax, rax
je 0x180007d50
nop word [rax + rax]
mov r8d, 0x100
lea rdx, [rbp + 0x1f0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rcx, str.Window_Title:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007d3a
lea rdx, [rbp + 0x1f0]
lea rcx, str.Window_Title:__s_n
call fcn.180001120
mov edx, 2
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindow]
mov rbx, rax
test rax, rax
jne 0x180007d00
lea rcx, str.Array_max:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007d72
mov edx, 5
lea rcx, str.Array_max:__d_n
call fcn.180001120
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1e8], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rax
mov dword [rbp + 0x10], eax
mov qword [rbp - 0x10], r14
xor edx, edx
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180007dc1
lea rcx, str.Error_creating_process_snapshot
call fcn.18001db60
jmp 0x180007e6b
mov dword [rbp + 0x20], 0x130
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x180007df0
lea rcx, str.Error_getting_first_process
call fcn.18001db60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, str.Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007e10
mov edx, dword [rbp + 0x28]
lea rcx, str.Process_ID:__lu_n
call fcn.180001120
lea rcx, str.Parent_Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007e30
mov edx, dword [rbp + 0x40]
lea rcx, str.Parent_Process_ID:__lu_n
call fcn.180001120
lea rcx, str.Process_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007e51
lea rdx, [rbp + 0x4c]
lea rcx, str.Process_Name:__s_n
call fcn.180001120
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180007df0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov bl, 0x41
test dil, 1
je 0x180007f28
mov byte [rsp + 0x58], bl
mov word [rsp + 0x59], 0x5c3a
mov byte [rsp + 0x5b], 0
lea r9, [rbp + 0x1d0]
lea r8, [rbp - 0x50]
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x180007f1c
lea rcx, str.Disk_Drive__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007ecd
lea rdx, [rsp + 0x58]
lea rcx, str.Disk_Drive__s_n
call fcn.180001120
lea rcx, str.__Total_Space:__llu_GB_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007ef2
mov rdx, qword [rbp - 0x50]
shr rdx, 0x1e
lea rcx, str.__Total_Space:__llu_GB_n
call fcn.180001120
lea rcx, str.__Free_Space:__llu_GB_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007f28
mov rdx, qword [rbp + 0x1d0]
shr rdx, 0x1e
lea rcx, str.__Free_Space:__llu_GB_n
call fcn.180001120
jmp 0x180007f28
lea rcx, str.Error_getting_disk_drive_information
call fcn.18001db60
shr edi, 1
inc bl
cmp bl, 0x5a
jle 0x180007e75
lea rcx, str.ASCII_character:__c_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007f57
mov edx, 0x41
lea rcx, str.ASCII_character:__c_n
call fcn.180001120
mov qword [rsp + 0x70], r14
movdqa xmm0, xmmword [0x18004d2a0]
movdqu xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x18004d2b0]
movdqu xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 9
lea rcx, str.Array_elements:_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007f9a
lea rcx, str.Array_elements:_n
call fcn.180001120
mov rdi, r14
nop dword [rax]
mov rbx, r14
lea rcx, [0x18004c408]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007fc8
lea rax, [rdi + rbx]
mov edx, dword [rbp + rax*4 - 0x50]
lea rcx, [0x18004c408]
call fcn.180001120
inc rbx
cmp rbx, 3
jl 0x180007fa3
lea rcx, [0x18004bd68]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180007fee
lea rcx, [0x18004bd68]
call fcn.180001120
add rdi, 3
cmp rdi, 9
jl 0x180007fa0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov bl, 0x41
test dil, 1
je 0x1800080b5
mov byte [rsp + 0x58], bl
mov word [rsp + 0x59], 0x5c3a
mov byte [rsp + 0x5b], 0
lea r9, [rbp + 0x1d0]
lea r8, [rbp - 0x50]
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x1800080a9
lea rcx, str.Disk_Drive__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000805a
lea rdx, [rsp + 0x58]
lea rcx, str.Disk_Drive__s_n
call fcn.180001120
lea rcx, str.__Total_Space:__llu_GB_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000807f
mov rdx, qword [rbp - 0x50]
shr rdx, 0x1e
lea rcx, str.__Total_Space:__llu_GB_n
call fcn.180001120
lea rcx, str.__Free_Space:__llu_GB_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800080b5
mov rdx, qword [rbp + 0x1d0]
shr rdx, 0x1e
lea rcx, str.__Free_Space:__llu_GB_n
call fcn.180001120
jmp 0x1800080b5
lea rcx, str.Error_getting_disk_drive_information
call fcn.18001db60
shr edi, 1
inc bl
cmp bl, 0x5a
jle 0x180008002
lea rcx, str.The_volume_of_the_sphere_with_radius__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsd xmm6, qword [0x18004d228]
test eax, eax
jns 0x18000810c
movaps xmm1, xmm6
movaps xmm0, xmm10
call fcn.180023360
mulsd xmm0, qword [0x18004d250]
movaps xmm2, xmm0
movq r8, xmm0
movaps xmm1, xmm10
movq rdx, xmm1
lea rcx, str.The_volume_of_the_sphere_with_radius__lf_is:__lf_n
call fcn.180001120
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f4], xmm0
movups xmmword [rbp + 0x204], xmm0
movups xmmword [rbp + 0x214], xmm0
movups xmmword [rbp + 0x224], xmm0
movups xmmword [rbp + 0x234], xmm0
movups xmmword [rbp + 0x244], xmm0
movups xmmword [rbp + 0x254], xmm0
movups xmmword [rbp + 0x264], xmm0
movups xmmword [rbp + 0x274], xmm0
mov dword [rbp + 0x1f0], 0x94
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x18000819c
lea rcx, str.Operating_System_Version:__d._d__Build__d__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800081b9
mov r9d, dword [rbp + 0x1fc]
mov r8d, dword [rbp + 0x1f8]
mov edx, dword [rbp + 0x1f4]
lea rcx, str.Operating_System_Version:__d._d__Build__d__n
call fcn.180001120
jmp 0x1800081b9
lea rcx, str.Failed_to_get_operating_system_version__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800081b9
lea rcx, str.Failed_to_get_operating_system_version__n
call fcn.180001120
lea rcx, str.Current_time:_07:38:26_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800081d6
lea rcx, str.Current_time:_07:38:26_n
call fcn.180001120
mov dword [rsp + 0x58], r14d
mov ecx, 0x1c
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x1800081f9
lea rcx, str.Error_allocating_memory_needed_to_call_GetExtendedTcpTable
call fcn.18001db60
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 5
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
cmp eax, 0x7a
jne 0x180008247
mov rcx, rsi
call fcn.180020c30
mov ecx, dword [rsp + 0x58]
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x180008247
lea rcx, str.Error_allocating_memory_needed_to_call_GetExtendedTcpTable
call fcn.18001db60
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 5
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
test eax, eax
jne 0x18000835c
mov r15d, r14d
cmp dword [rsi], r14d
jbe 0x18000836d
nop
mov r14d, r15d
lea rcx, str.Local_Address:__s:_u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800082c2
lea rdi, [r14 + r14*2]
movzx ecx, word [rsi + rdi*8 + 0xc]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ebx, ax
mov ecx, dword [rsi + rdi*8 + 8]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
mov r8d, ebx
lea rcx, str.Local_Address:__s:_u_n
call fcn.180001120
lea rcx, str.Remote_Address:__s:_u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008301
lea rdi, [r14 + r14*2]
movzx ecx, word [rsi + rdi*8 + 0x14]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ebx, ax
mov ecx, dword [rsi + rdi*8 + 0x10]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
mov r8d, ebx
lea rcx, str.Remote_Address:__s:_u_n
call fcn.180001120
lea rcx, str.State:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008326
lea rax, [r14 + r14*2]
mov edx, dword [rsi + rax*8 + 4]
lea rcx, str.State:__u_n
call fcn.180001120
lea rcx, str.PID:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000834b
lea rax, [r14 + r14*2]
mov edx, dword [rsi + rax*8 + 0x18]
lea rcx, str.PID:__u_n
call fcn.180001120
inc r15d
cmp r15d, dword [rsi]
jb 0x180008280
xor r14d, r14d
jmp 0x18000836d
lea rcx, str.GetExtendedTcpTable_failed_with_error
call fcn.18001db60
test rsi, rsi
je 0x180008375
mov rcx, rsi
call fcn.180020c30
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x18000932b
mov byte [rbp - 8], 8
lea rcx, str.Product_of__.2f_and__.2f_is__.2f_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800083e2
movsd xmm3, qword [0x18004d268]
movq r9, xmm3
movsd xmm2, qword [0x18004d248]
movq r8, xmm2
movsd xmm1, qword [0x18004d220]
movq rdx, xmm1
lea rcx, str.Product_of__.2f_and__.2f_is__.2f_n
call fcn.180001120
lea rcx, str.Quotient_of__d_and__d_is:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000840c
mov edx, 0x64
lea r9d, [rdx - 0x4b]
lea r8d, [rdx - 0x60]
lea rcx, str.Quotient_of__d_and__d_is:__d_n
call fcn.180001120
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.Processor_Architecture:
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008433
lea rcx, str.Processor_Architecture:
call fcn.180001120
movzx eax, word [rbp - 0x50]
test eax, eax
je 0x180008493
cmp eax, 5
je 0x180008479
cmp eax, 9
je 0x18000845f
lea rcx, str.Unknown_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800084b0
lea rcx, str.Unknown_n
jmp 0x1800084ab
lea rcx, str.AMD64_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800084b0
lea rcx, str.AMD64_n
jmp 0x1800084ab
lea rcx, str.ARM_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800084b0
lea rcx, str.ARM_n
jmp 0x1800084ab
lea rcx, str.Intel_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800084b0
lea rcx, str.Intel_n
call fcn.180001120
lea rcx, str.Number_of_Processors:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800084d0
mov edx, dword [rbp - 0x30]
lea rcx, str.Number_of_Processors:__u_n
call fcn.180001120
mov byte [rbp - 7], 2
lea rcx, str.Hello__World__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800084f1
lea rcx, str.Hello__World__n
call fcn.180001120
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180008603
mov ebx, r14d
mov r9d, 0x100
lea r8, [rbp + 0x1f0]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1800085f6
inc ebx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1f0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800085d4
mov dword [rbp + 0x1d0], 0x100
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800085ca
lea rcx, str.Installed_Program:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800085ca
lea rdx, [rbp + 0x20]
lea rcx, str.Installed_Program:__s_n
call fcn.180001120
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 0x100
lea r8, [rbp + 0x1f0]
mov edx, ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x180008545
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18000860f
lea rcx, str.Error_opening_registry_key
call fcn.18001db60
lea rcx, str.Decimal_integer:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008631
mov edx, 0x3039
lea rcx, str.Decimal_integer:__d_n
call fcn.180001120
mov word [rbp - 6], r14w
mov dword [rsp + 0x68], r14d
lea rdx, [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x1800086bf
mov ecx, dword [rsp + 0x68]
call fcn.180020ffc
mov rdi, rax
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1800086a9
mov rbx, rdi
test rdi, rdi
je 0x1800086b5
lea rcx, str.Network_Adapter:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008697
lea rdx, [rbx + 0x110]
lea rcx, str.Network_Adapter:__s_n
call fcn.180001120
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180008673
mov rcx, rdi
call fcn.180020c30
jmp 0x1800086cb
lea rcx, str.Error_getting_network_adapters
call fcn.18001db60
mov rcx, rdi
call fcn.180020c30
jmp 0x1800086cb
lea rcx, str.Error_getting_network_adapters
call fcn.18001db60
lea rcx, str.The_10th_Fibonacci_number_is:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800086ed
mov edx, 0x37
lea rcx, str.The_10th_Fibonacci_number_is:__d_n
call fcn.180001120
lea rcx, str.Long_long_integer:__lld_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008714
movabs rdx, 0x8000000000000000
lea rcx, str.Long_long_integer:__lld_n
call fcn.180001120
mov dword [rbp - 4], 0x660e
mov edi, 1
mov ebx, 1
mov esi, edi
nop word [rax + rax]
lea rcx, str._d___d___d
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008755
mov r9d, esi
mov r8d, edi
mov edx, ebx
lea rcx, str._d___d___d
call fcn.180001120
inc ebx
add esi, edi
cmp ebx, edi
jle 0x180008730
lea rcx, [0x18004bd68]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000877a
lea rcx, [0x18004bd68]
call fcn.180001120
inc edi
cmp edi, 9
jle 0x180008720
lea rcx, str._d_is_a_leap_year._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800087a3
mov edx, 0x7e4
lea rcx, str._d_is_a_leap_year._n
call fcn.180001120
lea rcx, str.Integer:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800087c5
mov edx, 0x3039
lea rcx, str.Integer:__d_n
call fcn.180001120
mov dword [rbp], 0x10
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800087f1
lea rcx, str.Error_creating_process_snapshot
call fcn.18001db60
jmp 0x18000889b
mov dword [rbp + 0x20], 0x130
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x180008820
lea rcx, str.Error_getting_first_process
call fcn.18001db60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, str.Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008840
mov edx, dword [rbp + 0x28]
lea rcx, str.Process_ID:__lu_n
call fcn.180001120
lea rcx, str.Parent_Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008860
mov edx, dword [rbp + 0x40]
lea rcx, str.Parent_Process_ID:__lu_n
call fcn.180001120
lea rcx, str.Process_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008881
lea rdx, [rbp + 0x4c]
lea rcx, str.Process_Name:__s_n
call fcn.180001120
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180008820
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Natural_Logarithm_of_10:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800088cd
movsd xmm0, qword [0x18004d270]
call fcn.18003a3a0
movaps xmm1, xmm0
movq rdx, xmm0
lea rcx, str.Natural_Logarithm_of_10:__lf_n
call fcn.180001120
lea rcx, str.Pi:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800088f7
movsd xmm1, qword [0x18004d240]
movq rdx, xmm1
lea rcx, str.Pi:__lf_n
call fcn.180001120
mov r8, r13
mov rdx, r12
lea rcx, [rbp + 4]
call fcn.18001a740
mov dword [rsp + 0x68], 0x10
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x180008944
lea rcx, str.Computer_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008961
lea rdx, [rbp - 0x50]
lea rcx, str.Computer_Name:__s_n
call fcn.180001120
jmp 0x180008961
lea rcx, str.Failed_to_get_computer_name__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008961
lea rcx, str.Failed_to_get_computer_name__n
call fcn.180001120
mov dword [rsp + 0x68], 0x10
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x1d0]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
je 0x1800089aa
lea rcx, str.Domain_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800089c7
lea rdx, [rbp + 0x1d0]
lea rcx, str.Domain_Name:__s_n
call fcn.180001120
jmp 0x1800089c7
lea rcx, str.Failed_to_get_domain_name__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800089c7
lea rcx, str.Failed_to_get_domain_name__n
call fcn.180001120
lea rcx, str.The_value_of_the_natural_logarithm_e_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800089f5
movaps xmm0, xmm10
call fcn.180039fa0
movaps xmm1, xmm0
movq rdx, xmm0
lea rcx, str.The_value_of_the_natural_logarithm_e_is:__lf_n
call fcn.180001120
lea r9, [rbp - 0x50]
lea r8, [rbp + 0x1d0]
lea rdx, [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x180008a43
lea rcx, str.Disk_Usage:__d_MB_Total___d_MB_Free_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008a60
mov r8, qword [rbp - 0x50]
shr r8, 0x14
mov rdx, qword [rbp + 0x1d0]
shr rdx, 0x14
lea rcx, str.Disk_Usage:__d_MB_Total___d_MB_Free_n
call fcn.180001120
jmp 0x180008a60
lea rcx, str.Failed_to_get_disk_usage__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008a60
lea rcx, str.Failed_to_get_disk_usage__n
call fcn.180001120
mov dword [rsp + 0x68], r14d
lea rdx, [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x180008b20
mov ecx, dword [rsp + 0x68]
call fcn.180020ffc
mov rdi, rax
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x180008b0a
mov rbx, rdi
test rdi, rdi
je 0x180008b16
lea rcx, str.MAC_Address:__02X__02X__02X__02X__02X__02X_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008af8
movzx eax, byte [rbx + 0x19d]
movzx ecx, byte [rbx + 0x19c]
movzx r10d, byte [rbx + 0x19b]
movzx r9d, byte [rbx + 0x19a]
movzx r8d, byte [rbx + 0x199]
movzx edx, byte [rbx + 0x198]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r10d
lea rcx, str.MAC_Address:__02X__02X__02X__02X__02X__02X_n
call fcn.180001120
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180008aa1
mov rcx, rdi
call fcn.180020c30
jmp 0x180008b2c
lea rcx, str.Error_getting_MAC_address
call fcn.18001db60
mov rcx, rdi
call fcn.180020c30
jmp 0x180008b2c
lea rcx, str.Error_getting_MAC_address
call fcn.18001db60
lea rcx, str.Fibonacci_number_at_position__d_is__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008b52
mov edx, 8
lea r8d, [rdx + 0xd]
lea rcx, str.Fibonacci_number_at_position__d_is__d_n
call fcn.180001120
mov dword [rsp + 0x68], r14d
mov ecx, 0x1c
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x180008b75
lea rcx, str.Error_allocating_memory_needed_to_call_GetExtendedTcpTable
call fcn.18001db60
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 5
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
cmp eax, 0x7a
jne 0x180008bc3
mov rcx, rsi
call fcn.180020c30
mov ecx, dword [rsp + 0x68]
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x180008bc3
lea rcx, str.Error_allocating_memory_needed_to_call_GetExtendedTcpTable
call fcn.18001db60
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 5
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
test eax, eax
jne 0x180008cdc
mov r15d, r14d
cmp dword [rsi], eax
jbe 0x180008ced
nop word [rax + rax]
mov r14d, r15d
lea rcx, str.Local_Address:__s:_u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008c42
lea rdi, [r14 + r14*2]
movzx ecx, word [rsi + rdi*8 + 0xc]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ebx, ax
mov ecx, dword [rsi + rdi*8 + 8]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
mov r8d, ebx
lea rcx, str.Local_Address:__s:_u_n
call fcn.180001120
lea rcx, str.Remote_Address:__s:_u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008c81
lea rdi, [r14 + r14*2]
movzx ecx, word [rsi + rdi*8 + 0x14]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ebx, ax
mov ecx, dword [rsi + rdi*8 + 0x10]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
mov r8d, ebx
lea rcx, str.Remote_Address:__s:_u_n
call fcn.180001120
lea rcx, str.State:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008ca6
lea rax, [r14 + r14*2]
mov edx, dword [rsi + rax*8 + 4]
lea rcx, str.State:__u_n
call fcn.180001120
lea rcx, str.PID:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008ccb
lea rax, [r14 + r14*2]
mov edx, dword [rsi + rax*8 + 0x18]
lea rcx, str.PID:__u_n
call fcn.180001120
inc r15d
cmp r15d, dword [rsi]
jb 0x180008c00
xor r14d, r14d
jmp 0x180008ced
lea rcx, str.GetExtendedTcpTable_failed_with_error
call fcn.18001db60
test rsi, rsi
je 0x180008cf5
mov rcx, rsi
call fcn.180020c30
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 8]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x180009069
xor r9d, r9d
lea r8, [rbp + 0x1e0]
lea edx, [r9 + 1]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x180009069
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
mov r8d, dword [rbp + 0x390]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.1800065f0
test al, al
je 0x180009069
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov r8d, dword [rsp + 0x5c]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x78]
call fcn.1800149b0
lea rax, [rsp + 0x78]
mov rbx, qword [rsp + 0x48]
cmp rbx, rax
je 0x180008dfa
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180008ddd
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180008dd8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180009865
mov rcx, r8
call fcn.180018cc0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rbx + 0x10], xmm1
jmp 0x180008e36
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x180008e36
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008e31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009865
call fcn.180018cc0
lea rcx, str._d_is_negative_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008e58
mov edx, 0xfffffffb
lea rcx, str._d_is_negative_n
call fcn.180001120
lea rcx, str.Null_pointer:__p_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008e77
xor edx, edx
lea rcx, str.Null_pointer:__p_n
call fcn.180001120
lea rcx, str.Factorial_of__d:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008e9d
mov edx, 5
lea r8d, [rdx + 0x73]
lea rcx, str.Factorial_of__d:__d_n
call fcn.180001120
mov rcx, qword [rsp + 0x60]
call fcn.180020c30
lea rcx, str.The_height_of_the_equilateral_triangle_with_side__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008ef7
xorps xmm0, xmm0
ucomisd xmm0, xmm6
ja 0x180008eca
xorps xmm0, xmm0
sqrtsd xmm0, xmm6
jmp 0x180008ed2
movaps xmm0, xmm6
call fcn.18003ae3c
mulsd xmm0, qword [0x18004d200]
movaps xmm2, xmm0
movq r8, xmm0
movaps xmm1, xmm10
movq rdx, xmm1
lea rcx, str.The_height_of_the_equilateral_triangle_with_side__lf_is:__lf_n
call fcn.180001120
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x180008f2b
lea rcx, str.Mouse_Position:__ld___ld_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180008f37
mov r8d, dword [rbp - 0x4c]
mov edx, dword [rbp - 0x50]
lea rcx, str.Mouse_Position:__ld___ld_n
call fcn.180001120
jmp 0x180008f37
lea rcx, str.Error_getting_mouse_position
call fcn.18001db60
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
lea rcx, str.System_Uptime:__d_days___d_hours___d_minutes___d_seconds_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000901b
movabs rax, 0x8daea1d7f4cf721b
mul rbx
mov r10, rbx
sub r10, rdx
shr r10, 1
add r10, rdx
shr r10, 0x1a
movabs rcx, 0x179ec9cbd821dc3b
mov rax, rcx
mul rbx
mov rax, rbx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0xf
imul rax, rax, 0xea60
mov r9, rbx
sub r9, rax
movabs rax, 0x624dd2f1a9fbe77
mul r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 9
movabs r11, 0x4a90be587de6e565
mov rax, r11
mul rbx
shr rdx, 0x14
imul rax, rdx, 0x36ee80
mov r8, rbx
sub r8, rax
mov rax, rcx
mul r8
sub r8, rdx
shr r8, 1
add r8, rdx
shr r8, 0xf
imul rax, r10, 0x5265c00
sub rbx, rax
mov rax, r11
mul rbx
shr rdx, 0x14
mov dword [rsp + 0x20], r9d
mov r9d, r8d
mov r8d, edx
mov edx, r10d
lea rcx, str.System_Uptime:__d_days___d_hours___d_minutes___d_seconds_n
call fcn.180001120
mov ebx, r14d
mov dword [rbp - 0x50], 8
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x18000904a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rbp - 0x4c]
mov eax, 0x10624dd3
mul ecx
mov ebx, edx
shr ebx, 6
lea rcx, str.Idle_Time:__d_seconds_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009069
mov edx, ebx
lea rcx, str.Idle_Time:__d_seconds_n
call fcn.180001120
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.Processor_Architecture:
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009091
lea rcx, str.Processor_Architecture:
call fcn.180001120
movzx eax, word [rsp + 0x78]
test eax, eax
je 0x1800090f2
cmp eax, 5
je 0x1800090d8
cmp eax, 9
je 0x1800090be
lea rcx, str.Unknown_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000910f
lea rcx, str.Unknown_n
jmp 0x18000910a
lea rcx, str.AMD64_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000910f
lea rcx, str.AMD64_n
jmp 0x18000910a
lea rcx, str.ARM_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000910f
lea rcx, str.ARM_n
jmp 0x18000910a
lea rcx, str.Intel_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000910f
lea rcx, str.Intel_n
call fcn.180001120
lea rcx, str.Number_of_Processors:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000912f
mov edx, dword [rbp - 0x68]
lea rcx, str.Number_of_Processors:__u_n
call fcn.180001120
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, str.Current_Time_2:__d__d__d__d:_d:_d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009184
movzx eax, word [rbp - 0x7c]
movzx r10d, word [rbp - 0x7e]
movzx r11d, word [rbp - 0x80]
movzx r9d, word [rsp + 0x7e]
movzx r8d, word [rsp + 0x7a]
movzx edx, word [rsp + 0x78]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
lea rcx, str.Current_Time_2:__d__d__d__d:_d:_d_n
call fcn.180001120
lea rdx, str.Security
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov rdi, rax
test rax, rax
je 0x18000931f
mov ecx, 0x10000
call fcn.180020ffc
mov rbx, rax
test rax, rax
je 0x180009308
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, rbx
xor r8d, r8d
lea edx, [r8 + 5]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
je 0x1800092f5
nop dword [rax]
lea rcx, str.Event_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009210
mov edx, dword [rbx + 0x14]
lea rcx, str.Event_ID:__lu_n
call fcn.180001120
lea rcx, str.Event_Type:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009231
movzx edx, word [rbx + 0x18]
lea rcx, str.Event_Type:__lu_n
call fcn.180001120
lea rcx, str.Event_Category:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009252
movzx edx, word [rbx + 0x1c]
lea rcx, str.Event_Category:__lu_n
call fcn.180001120
lea rcx, str.Time_Generated:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000927b
lea rcx, [rbx + 0xc]
call fcn.180020f88
mov rdx, rax
lea rcx, str.Time_Generated:__s_n
call fcn.180001120
lea rcx, str.Source_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000929e
mov edx, dword [rbx + 0x24]
add rdx, rbx
lea rcx, str.Source_Name:__s_n
call fcn.180001120
lea rcx, str.Event_String:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800092c1
mov edx, dword [rbx + 0x34]
add rdx, rbx
lea rcx, str.Event_String:__s_n
call fcn.180001120
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, rbx
xor r8d, r8d
lea edx, [r8 + 5]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
jne 0x1800091f0
mov rcx, rbx
call fcn.180020c30
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x18000932b
lea rcx, str.Error_allocating_memory_for_event_log_record
call fcn.18001db60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x18000932b
lea rcx, str.Error_opening_event_log
call fcn.18001db60
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x18000953e
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, str.Named_Pipe_List:_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000935d
lea rcx, str.Named_Pipe_List:_n
call fcn.180001120
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str..pipe
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800093b0
lea rcx, str.Failed_to_open_the_pipe_list._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800093f2
lea rcx, str.Failed_to_open_the_pipe_list._n
call fcn.180001120
jmp 0x1800093f2
mov r8d, 0x100
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x1800093e9
lea rcx, [0x18004bd88]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800093b0
lea rdx, [rbp + 0x20]
lea rcx, [0x18004bd88]
call fcn.180001120
jmp 0x1800093b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.This_is_a_fixed_string._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000940f
lea rcx, str.This_is_a_fixed_string._n
call fcn.180001120
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.180014bf0
movzx edx, word [rsp + 0x78]
test edx, edx
je 0x18000949f
sub edx, 5
je 0x180009485
sub edx, 1
je 0x18000946b
cmp edx, 3
je 0x180009451
lea rcx, str.Unknown_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800094bc
lea rcx, str.Unknown_n
jmp 0x1800094b7
lea rcx, str.x64_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800094bc
lea rcx, str.x64_n
jmp 0x1800094b7
lea rcx, str.IA64_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800094bc
lea rcx, str.IA64_n
jmp 0x1800094b7
lea rcx, str.ARM_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800094bc
lea rcx, str.ARM_n
jmp 0x1800094b7
lea rcx, str.x86_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800094bc
lea rcx, str.x86_n
call fcn.180001120
lea rcx, str.Number_of_Processors:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800094dc
mov edx, dword [rbp - 0x68]
lea rcx, str.Number_of_Processors:__d_n
call fcn.180001120
lea rcx, str.Processor_Type:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800094fc
mov edx, dword [rbp - 0x64]
lea rcx, str.Processor_Type:__d_n
call fcn.180001120
lea rcx, str.Processor_Level:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000951d
movzx edx, word [rbp - 0x5c]
lea rcx, str.Processor_Level:__d_n
call fcn.180001120
lea rcx, str.Processor_Revision:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000953e
movzx edx, word [rbp - 0x5a]
lea rcx, str.Processor_Revision:__d_n
call fcn.180001120
lea rcx, str._c_is_a_lowercase_letter._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009560
mov edx, 0x65
lea rcx, str._c_is_a_lowercase_letter._n
call fcn.180001120
lea rcx, str.Unsigned_long_long_integer:__llu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009584
mov rdx, 0xffffffffffffffff
lea rcx, str.Unsigned_long_long_integer:__llu_n
call fcn.180001120
xor ecx, ecx
call fcn.180020884
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.180020be0
mov r9, rax
lea r8, str._Y__m__d__H:_M:_S
mov edx, 0x14
lea rcx, [rbp - 0x50]
call fcn.18001e084
lea rcx, str.Current_Time_3:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800095d3
lea rdx, [rbp - 0x50]
lea rcx, str.Current_Time_3:__s_n
call fcn.180001120
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x18000982c
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
lea rcx, str.Sum_of__d_and__d_is__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009611
mov edx, 5
lea r9d, [rdx + 3]
lea r8d, [rdx - 2]
lea rcx, str.Sum_of__d_and__d_is__d_n
call fcn.180001120
lea rcx, str.ASCII_value_of__c:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009636
mov edx, 0x41
mov r8d, edx
lea rcx, str.ASCII_value_of__c:__d_n
call fcn.180001120
mov dword [rbp + 0x1d0], 0x2c0
mov ecx, 0x2c0
call fcn.180020ffc
mov rdi, rax
test rax, rax
jne 0x180009663
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersInfo
call fcn.18001db60
jmp 0x18000982c
lea rdx, [rbp + 0x1d0]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x18000969f
mov rcx, rdi
call fcn.180020c30
mov ecx, dword [rbp + 0x1d0]
call fcn.180020ffc
mov rdi, rax
test rax, rax
jne 0x18000969f
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersInfo
call fcn.18001db60
lea rdx, [rbp + 0x1d0]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x180009813
mov rbx, rdi
test rdi, rdi
je 0x18000982c
lea rsi, [0x18004c674]
nop word [rax + rax]
lea rcx, str.Adapter_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800096f1
lea rdx, [rbx + 0xc]
lea rcx, str.Adapter_Name:__s_n
call fcn.180001120
lea rcx, str.Adapter_Description:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009715
lea rdx, [rbx + 0x110]
lea rcx, str.Adapter_Description:__s_n
call fcn.180001120
lea rcx, str.Adapter_Address:__02X__02X__02X__02X__02X__02X_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000976c
movzx eax, byte [rbx + 0x19d]
movzx ecx, byte [rbx + 0x19c]
movzx r10d, byte [rbx + 0x19b]
movzx r9d, byte [rbx + 0x19a]
movzx r8d, byte [rbx + 0x199]
movzx edx, byte [rbx + 0x198]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r10d
lea rcx, str.Adapter_Address:__02X__02X__02X__02X__02X__02X_n
call fcn.180001120
lea rcx, str.Adapter_Index:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000978f
mov edx, dword [rbx + 0x1a0]
lea rcx, str.Adapter_Index:__u_n
call fcn.180001120
lea rcx, str.Type:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800097b2
mov edx, dword [rbx + 0x1a4]
lea rcx, str.Type:__u_n
call fcn.180001120
lea rcx, str.DHCP_Enabled:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800097e1
lea rdx, [0x18004c678]
cmp dword [rbx + 0x1a8], 0
cmovne rdx, rsi
lea rcx, str.DHCP_Enabled:__s_n
call fcn.180001120
lea rcx, str.DHCP_Server:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180009805
lea rdx, [rbx + 0x220]
lea rcx, str.DHCP_Server:__s_n
call fcn.180001120
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1800096d0
jmp 0x180009824
lea rcx, str.GetAdaptersInfo_failed_with_error
call fcn.18001db60
test rdi, rdi
je 0x18000982c
mov rcx, rdi
call fcn.180020c30
mov rax, qword [rsp + 0x48]
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.180018ca0
movaps xmm6, xmmword [rsp + 0x410]
movaps xmm10, xmmword [rsp + 0x400]
add rsp, 0x428
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18001e488
int3