Function at 0x1400114ec
Capabilities:
Contain obfuscated stackstrings
Execute command
Log keystrokes via polling

Disassembly:
jmp 0x140017c00
push rbp
push rdi
sub rsp, 0x478
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140028018]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x14002e0f4]
call fcn.1400116f9
call fcn.1400111b8
movzx eax, al
test eax, eax
jne 0x140017c76
lea rdx, str.Incorrect_password._Exiting.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x1400182d2
lea rdx, str.Plants_vs._Zombies
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rbp + 8], rax
lea rdx, [rbp + 0x24]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 0x24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x140017ce0
lea rdx, str.Gagal_membuka_handle_proses.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x1400182d2
lea rcx, [0x140023974]
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str.Selamat_Datang_Sesen
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.tekan___untuk_kebal
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.tekan__untuk_instant_plant
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.tekan_9_untuk_unlimited_sun
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp + 0x68], 0x48728c
mov qword [rbp + 0x88], 0x52fcf0
mov qword [rbp + 0xa8], 0x53130f
mov byte [rbp + 0xc4], 0x81
mov byte [rbp + 0xc5], 0x47
mov byte [rbp + 0xc6], 0x24
mov byte [rbp + 0xc7], 0xc8
mov byte [rbp + 0xc8], 0
mov byte [rbp + 0xc9], 0
mov byte [rbp + 0xca], 0
mov byte [rbp + 0xe4], 0x90
mov byte [rbp + 0xe5], 0x90
mov byte [rbp + 0xe6], 0x90
mov byte [rbp + 0xe7], 0x90
mov byte [rbp + 0xe8], 0x90
mov byte [rbp + 0xe9], 0x90
mov byte [rbp + 0xea], 0x90
mov byte [rbp + 0x104], 0x2b
mov byte [rbp + 0x105], 0x3c
mov byte [rbp + 0x106], 0x24
mov byte [rbp + 0x107], 0x90
mov qword [rbp + 0x128], 0x531053
mov qword [rbp + 0x148], 0x53105e
mov qword [rbp + 0x168], 0x530ca1
mov qword [rbp + 0x188], 0x45f8ca
mov byte [rbp + 0x1a4], 0xeb
mov byte [rbp + 0x1a5], 9
mov byte [rbp + 0x1c4], 0x2b
mov byte [rbp + 0x1c5], 0x8d
mov byte [rbp + 0x1c6], 0xd0
mov byte [rbp + 0x1c7], 0
mov byte [rbp + 0x1c8], 0
mov byte [rbp + 0x1c9], 0
mov byte [rbp + 0x1e4], 0x89
mov byte [rbp + 0x1e5], 0x86
mov byte [rbp + 0x1e6], 0xdc
mov byte [rbp + 0x204], 0xc7
mov byte [rbp + 0x205], 0x46
mov byte [rbp + 0x206], 0x58
mov byte [rbp + 0x207], 0x25
mov byte [rbp + 0x208], 0
mov byte [rbp + 0x209], 0
mov byte [rbp + 0x20a], 0
xor eax, eax
cmp eax, 1
je 0x1400182c6
mov ecx, 0x6b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140017f50
mov qword [rsp + 0x20], 0
mov r9d, 7
lea r8, [rbp + 0xc4]
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str.Opcode_pada_alamat
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
lea rdx, [0x14001167c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, str._telah_diubah.
mov rcx, rax
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x6d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140017fdc
mov qword [rsp + 0x20], 0
mov r9d, 7
lea r8, [rbp + 0xe4]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str.Opcode_pada_alamat
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
lea rdx, [0x14001167c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rbp + 0x88]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, str._telah_diubah.
mov rcx, rax
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x69
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14001814c
mov qword [rbp + 0x228], 0x19984c
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rbp + 0x248]
mov rdx, qword [rbp + 0x228]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140018129
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x248]
and rcx, rax
mov rax, rcx
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
add rax, 0x5560
mov qword [rbp + 0x268], rax
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x284]
mov rdx, qword [rbp + 0x268]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140018104
mov dword [rbp + 0x2a4], 0xaa289
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x2a4]
mov rdx, qword [rbp + 0x268]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400180df
lea rdx, str.Nilai_diubah_menjadi:_6969
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140018102
lea rdx, str.Gagal_mengubah_nilai_di_alamat_memori.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140018127
lea rdx, str.Gagal_membaca_memori.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001814c
lea rdx, str.Gagal_membaca_nilai_pointer.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x68
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400182b6
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x104]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], 0
mov r9d, 2
lea r8, [rbp + 0x1a4]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], 0
mov r9d, 6
lea r8, [rbp + 0x1c4]
mov rdx, qword [rbp + 0x148]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], 0
mov r9d, 3
lea r8, [rbp + 0x1e4]
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], 0
mov r9d, 7
lea r8, [rbp + 0x204]
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str.Opcodes_pada_alamat
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
lea rdx, [0x14001167c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140023ad4]
mov rcx, rax
call fcn.1400110c8
mov rdx, qword [rbp + 0x148]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, str.__dan
mov rcx, rax
call fcn.1400110c8
mov rdx, qword [rbp + 0x168]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, str._telah_diubah.
mov rcx, rax
call fcn.1400110c8
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140017ebf
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140023510]
call fcn.1400115d2
mov rax, rdi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.140011366
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret