Function at 0x1800105d0
Capabilities:
Enumerate processes
Get hostname
Get local ipv4 addresses
List tcp connections and listeners
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rbx
push r12
push r13
push r14
lea rbp, [r11 - 0xe8]
sub rsp, 0x1c0
mov rax, qword [0x180053028]
xor rax, rsp
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x70], rcx
mov r13, rdx
mov qword [rbp + 0x70], rdx
mov r12, rcx
mov qword [r11 + 0x18], rsi
lea rdx, [rsp + 0x30]
mov qword [r11 - 0x30], rdi
xor r14d, r14d
xor ecx, ecx
movaps xmmword [r11 - 0x48], xmm6
mov dword [rsp + 0x30], r14d
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x1800106ac
mov ecx, dword [rsp + 0x30]
call fcn.180020ffc
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x180010696
mov rbx, rdi
test rdi, rdi
je 0x1800106a2
nop word [rax + rax]
lea rcx, str.Network_Adapter:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010684
lea rdx, [rbx + 0x110]
lea rcx, str.Network_Adapter:__s_n
call fcn.180001120
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180010660
mov rcx, rdi
call fcn.180020c30
jmp 0x1800106b8
lea rcx, str.Error_getting_network_adapters
call fcn.18001db60
mov rcx, rdi
call fcn.180020c30
jmp 0x1800106b8
lea rcx, str.Error_getting_network_adapters
call fcn.18001db60
lea rax, [rbp + 0x70]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180010769
mov rcx, qword [rbp + 0x70]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rbp + 0x80]
mov dword [rsp + 0x30], 0x14
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.InstallDate
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180010751
lea rcx, str.Operating_System_Install_Date:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18001075d
lea rdx, [rbp + 0x80]
lea rcx, str.Operating_System_Install_Date:__s_n
call fcn.180001120
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180010775
lea rcx, str.Error_getting_OS_install_date
call fcn.18001db60
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180010775
lea rcx, str.Error_opening_registry_key
call fcn.18001db60
lea rcx, str.Octal_integer:__o_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010797
mov edx, 0x53
lea rcx, str.Octal_integer:__o_n
call fcn.180001120
mov edi, 1
nop dword [rax]
mov ebx, 1
mov esi, edi
nop word [rax + rax]
lea rcx, str._d___d___d
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800107d5
mov r9d, esi
lea rcx, str._d___d___d
mov r8d, edi
mov edx, ebx
call fcn.180001120
inc ebx
add esi, edi
cmp ebx, edi
jle 0x1800107b0
lea rcx, [0x18004bd68]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800107fa
lea rcx, [0x18004bd68]
call fcn.180001120
inc edi
cmp edi, 9
jle 0x1800107a0
lea rcx, str.Product_of__.2f_and__.2f_is__.2f_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010845
movsd xmm3, qword [0x18004d268]
lea rcx, str.Product_of__.2f_and__.2f_is__.2f_n
movsd xmm2, qword [0x18004d248]
movq r9, xmm3
movsd xmm1, qword [0x18004d220]
movq r8, xmm2
movq rdx, xmm1
call fcn.180001120
lea rcx, str.Array_max:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010867
mov edx, 5
lea rcx, str.Array_max:__d_n
call fcn.180001120
cmp qword [r12 + 0x18], 0x10
jb 0x180010880
mov rbx, qword [r12]
mov rdi, rbx
mov rsi, rbx
add rdi, qword [r12 + 0x10]
jmp 0x18001088e
mov rdi, qword [r12 + 0x10]
mov rbx, r12
add rdi, r12
mov rsi, r12
cmp rbx, rdi
je 0x1800108a9
sub rsi, rbx
movsx ecx, byte [rbx]
call fcn.18001e230
mov byte [rsi + rbx], al
inc rbx
cmp rbx, rdi
jne 0x180010896
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800108ce
lea rcx, str.Error_creating_process_snapshot
call fcn.18001db60
jmp 0x18001097f
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x180010900
lea rcx, str.Error_getting_first_process
call fcn.18001db60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax]
lea rcx, str.Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010921
mov edx, dword [rsp + 0x48]
lea rcx, str.Process_ID:__lu_n
call fcn.180001120
lea rcx, str.Parent_Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010942
mov edx, dword [rsp + 0x60]
lea rcx, str.Parent_Process_ID:__lu_n
call fcn.180001120
lea rcx, str.Process_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010964
lea rdx, [rsp + 0x6c]
lea rcx, str.Process_Name:__s_n
call fcn.180001120
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180010900
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Boolean_value:_true_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18001099c
lea rcx, str.Boolean_value:_true_n
call fcn.180001120
lea rcx, str.Pi:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800109c6
movsd xmm1, qword [0x18004d240]
lea rcx, str.Pi:__lf_n
movq rdx, xmm1
call fcn.180001120
lea rcx, str.The_value_of_Eulers_number_e_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsd xmm6, qword [0x18004d210]
test eax, eax
jns 0x1800109fb
movaps xmm0, xmm6
call fcn.180039fa0
movaps xmm1, xmm0
lea rcx, str.The_value_of_Eulers_number_e_is:__lf_n
movq rdx, xmm0
call fcn.180001120
lea rcx, str.Mouse_Button_State:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010a3a
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
lea rax, str.Pressed
lea rdx, str.Released
cmovb rdx, rax
lea rcx, str.Mouse_Button_State:__s_n
call fcn.180001120
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x10
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x180010a78
lea rcx, str.Computer_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010a95
lea rdx, [rbp + 0x70]
lea rcx, str.Computer_Name:__s_n
call fcn.180001120
jmp 0x180010a95
lea rcx, str.Failed_to_get_computer_name__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010a95
lea rcx, str.Failed_to_get_computer_name__n
call fcn.180001120
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 0x10
lea rdx, [rbp + 0x80]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
je 0x180010ade
lea rcx, str.Domain_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010afb
lea rdx, [rbp + 0x80]
lea rcx, str.Domain_Name:__s_n
call fcn.180001120
jmp 0x180010afb
lea rcx, str.Failed_to_get_domain_name__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010afb
lea rcx, str.Failed_to_get_domain_name__n
call fcn.180001120
cmp qword [r13 + 0x18], 0x10
mov rdi, qword [r13 + 0x10]
jb 0x180010b12
mov rbx, qword [r13]
add rdi, rbx
mov rsi, rbx
jmp 0x180010b1b
add rdi, r13
mov rbx, r13
mov rsi, r13
cmp rbx, rdi
je 0x180010b36
sub rsi, rbx
movsx ecx, byte [rbx]
call fcn.18001e230
mov byte [rsi + rbx], al
inc rbx
cmp rbx, rdi
jne 0x180010b23
mov ecx, 2
nop dword [rax + rax]
mov eax, 0x11
cdq
idiv ecx
test edx, edx
je 0x180010b6d
inc ecx
cmp ecx, 8
jle 0x180010b40
lea rcx, str._d_is_a_prime_number._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010b8f
lea rcx, str._d_is_a_prime_number._n
jmp 0x180010b85
lea rcx, str._d_is_not_a_prime_number._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010b8f
lea rcx, str._d_is_not_a_prime_number._n
mov edx, 0x11
call fcn.180001120
lea rcx, str.The_surface_area_of_the_sphere_with_radius__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010bc1
movsd xmm2, qword [0x18004d278]
lea rcx, str.The_surface_area_of_the_sphere_with_radius__lf_is:__lf_n
movq r8, xmm2
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.180001120
xorps xmm0, xmm0
mov dword [rsp + 0x40], 0x94
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x180010c30
lea rcx, str.Operating_System_Version:__d._d__Build__d__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010c4d
mov r9d, dword [rsp + 0x4c]
lea rcx, str.Operating_System_Version:__d._d__Build__d__n
mov r8d, dword [rsp + 0x48]
mov edx, dword [rsp + 0x44]
call fcn.180001120
jmp 0x180010c4d
lea rcx, str.Failed_to_get_operating_system_version__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010c4d
lea rcx, str.Failed_to_get_operating_system_version__n
call fcn.180001120
mov ecx, 0x1c
mov dword [rsp + 0x30], r14d
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x180010c70
lea rcx, str.Error_allocating_memory_needed_to_call_GetExtendedTcpTable
call fcn.18001db60
mov dword [rsp + 0x28], r14d
lea rdx, [rsp + 0x30]
mov r9d, 2
mov dword [rsp + 0x20], 5
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
cmp eax, 0x7a
jne 0x180010cbe
mov rcx, rsi
call fcn.180020c30
mov ecx, dword [rsp + 0x30]
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x180010cbe
lea rcx, str.Error_allocating_memory_needed_to_call_GetExtendedTcpTable
call fcn.18001db60
mov dword [rsp + 0x28], r14d
lea rdx, [rsp + 0x30]
mov r9d, 2
mov dword [rsp + 0x20], 5
xor r8d, r8d
mov qword [rsp + 0x1b0], r15
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
test eax, eax
jne 0x180010ddc
mov r15d, r14d
cmp dword [rsi], r14d
jbe 0x180010ded
nop
lea rcx, str.Local_Address:__s:_u_n
mov r14d, r15d
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010d42
lea rdi, [r14 + r14*2]
movzx ecx, word [rsi + rdi*8 + 0xc]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [rsi + rdi*8 + 8]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8d, ebx
lea rcx, str.Local_Address:__s:_u_n
mov rdx, rax
call fcn.180001120
lea rcx, str.Remote_Address:__s:_u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010d81
lea rdi, [r14 + r14*2]
movzx ecx, word [rsi + rdi*8 + 0x14]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [rsi + rdi*8 + 0x10]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8d, ebx
lea rcx, str.Remote_Address:__s:_u_n
mov rdx, rax
call fcn.180001120
lea rcx, str.State:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010da6
lea rax, [r14 + r14*2]
mov edx, dword [rsi + rax*8 + 4]
lea rcx, str.State:__u_n
call fcn.180001120
lea rcx, str.PID:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010dcb
lea rax, [r14 + r14*2]
mov edx, dword [rsi + rax*8 + 0x18]
lea rcx, str.PID:__u_n
call fcn.180001120
inc r15d
cmp r15d, dword [rsi]
jb 0x180010d00
xor r14d, r14d
jmp 0x180010ded
lea rcx, str.GetExtendedTcpTable_failed_with_error
call fcn.18001db60
test rsi, rsi
je 0x180010df5
mov rcx, rsi
call fcn.180020c30
lea rcx, str.The_area_of_the_triangle_with_base__lf_and_height__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r15, qword [rsp + 0x1b0]
mov rdi, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x200]
test eax, eax
jns 0x180010e47
movsd xmm3, qword [0x18004d200]
lea rcx, str.The_area_of_the_triangle_with_base__lf_and_height__lf_is:__lf_n
movq r9, xmm3
movaps xmm2, xmm6
movq r8, xmm6
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.180001120
lea rcx, str.The_natural_logarithm_of_10_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movaps xmm6, xmmword [rsp + 0x1a0]
test eax, eax
jns 0x180010e81
movsd xmm0, qword [0x18004d270]
call fcn.18003a3a0
movaps xmm1, xmm0
lea rcx, str.The_natural_logarithm_of_10_is:__lf_n
movq rdx, xmm0
call fcn.180001120
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call fcn.1800145c0
mov rdx, qword [r12 + 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x180010ece
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x180010ec9
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180010f4b
mov rcx, r8
call fcn.180018cc0
mov qword [r12 + 0x10], r14
mov qword [r12 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r12], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x180010f18
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x180010f13
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180010f4b
mov rcx, r8
call fcn.180018cc0
mov qword [r13 + 0x10], r14
mov rax, rbx
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rcx, qword [rbp + 0x98]
xor rcx, rsp
call fcn.180018ca0
add rsp, 0x1c0
pop r14
pop r13
pop r12
pop rbx
pop rbp
ret
call fcn.18001e488
int3