Function at 0x1400034d0
Capabilities:
Create thread
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor esi, esi
lea rdx, [0x1400057c0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea rdx, str.ZIP_HELPER
call qword [sym.imp.USER32.dll_SetWindowTextA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 0x12c
mov dword [rsp + 0x20], 0x1f4
xor edx, edx
mov r9d, 0xc8
mov r8d, r9d
call qword [sym.imp.USER32.dll_SetWindowPos]
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x1400035c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140003a10
mov rbx, rax
lea rdx, str._message:_t
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002d80
mov rcx, rax
lea rdx, str.need_admin_rights
call fcn.140002d80
mov rcx, rax
lea rdx, str._n_system_error:_t
call fcn.140002d80
mov rcx, rax
mov rdx, rbx
call fcn.140002d80
mov rcx, rax
mov dl, 0xa
call fcn.140002f60
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ebx, esi
nop word [rax + rax]
lea rcx, [0x1400057ec]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._a_d__choose_ziphelper_mode:_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002d80
add ebx, 2
and ebx, 0x80000001
jge 0x140003602
dec ebx
or ebx, 0xfffffffe
inc ebx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test ebx, ebx
jne 0x14000361d
lea rdi, str.cmd_n
lea rdx, str._dll_
jmp 0x14000362b
lea rdi, str._cmd__n
lea rdx, [0x140005828]
call fcn.140002d80
mov dl, 9
mov rcx, rax
call fcn.140002f60
mov rcx, rax
mov rdx, rdi
call fcn.140002d80
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
cmp eax, 0xd
je 0x14000366c
cmp eax, 0x64
jne 0x14000365c
inc ebx
jmp 0x1400035d0
cmp eax, 0x61
jne 0x1400035d0
dec ebx
jmp 0x1400035d0
test ebx, ebx
jne 0x140003719
lea rdx, str.notepad.exe
lea rcx, [rbp - 0x49]
call fcn.1400028f0
nop
lea rcx, [rbp - 0x49]
call fcn.140001470
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 7
jbe 0x1400036d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400036cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d5c
lea rdx, str.dll_injected_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002d80
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140003d00
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov dword [rbp - 0x29], 0x8d
mov dword [rbp - 0x25], esi
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
mov qword [rbp - 1], rsi
mov qword [rbp + 7], rsi
mov dword [rbp + 0x3f], 0xffffffff
mov dword [rbp - 9], 2
mov dword [rbp + 0x43], esi
lea rax, [rbp - 9]
mov qword [rbp - 0x49], rax
lea rax, [rbp - 0x25]
mov qword [rbp - 0x41], rax
lea rax, [rbp - 0x29]
mov qword [rbp - 0x39], rax
mov ecx, 0x18
call fcn.140003d20
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rax], xmm0
movsd xmm1, qword [rbp - 0x39]
movsd qword [rax + 0x10], xmm1
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140003c20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x19], rax
test rax, rax
je 0x140003888
lea rdi, [0x140005858]
nop word [rax + rax]
mov ebx, esi
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400037fa
cmp ebx, dword [rbp - 0x29]
je 0x1400037ff
inc ebx
mov qword [rbp - 0x21], 1
lea rcx, [rbp - 0x21]
call fcn.140003a70
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1400037d2
cmp ebx, dword [rbp - 0x29]
jne 0x140003820
call fcn.140003960
cmp dword [rbp - 0x25], 0
je 0x140003820
mov qword [rbp - 0x21], 0xc8
lea rcx, [rbp - 0x21]
call fcn.140003a70
call fcn.140003960
lea rbx, [0x14000585c]
cmp dword [rbp - 0x25], 0
cmovne rbx, rdi
lea rdx, str.frame_counter:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002d80
mov rcx, rax
mov edx, dword [rbp - 0x29]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, str.__DOUBLE_CLICK:
call fcn.140002d80
mov rcx, rax
mov rdx, rbx
call fcn.140002d80
mov rcx, rax
mov dl, 0xd
call fcn.140002f60
mov qword [rbp - 0x21], 1
lea rcx, [rbp - 0x21]
call fcn.140003a70
jmp 0x1400037c0
mov dword [rbp - 0x11], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3