Function at 0x14001160e
Capabilities:
Execute command
Terminate process

Disassembly:
jmp 0x140018dd0
push rbp
push rdi
sub rsp, 0xf98
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2ba
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002d040]
xor rax, rbp
mov qword [rbp + 0xf50], rax
lea rcx, [0x14003414c]
call fcn.1400118b6
lea rcx, [rbp + 8]
call fcn.1400118a7
nop
lea rcx, [rbp + 0x48]
call fcn.1400118a7
nop
lea rax, [rbp + 0x9e8]
mov qword [rbp + 0xa28], rax
lea rax, [rbp + 0xa48]
mov qword [rbp + 0xa88], rax
lea rdx, str.version.php
mov rcx, qword [rbp + 0xa28]
call fcn.1400113f7
mov qword [rbp + 0xf38], rax
mov rax, qword [rbp + 0xf38]
mov qword [rbp + 0xf40], rax
lea rdx, str.yourwebsite.com
mov rcx, qword [rbp + 0xa88]
call fcn.1400113f7
mov qword [rbp + 0xf48], rax
mov r9, qword [rbp + 0xf40]
mov r8, qword [rbp + 0xf48]
lea rdx, [rbp + 0x88]
mov rcx, qword [0x14002d4c0]
call fcn.1400118f2
nop
lea rdx, str.1.0.0
lea rcx, [rbp + 0xac8]
call fcn.1400113f7
mov qword [rbp + 0xf38], rax
mov rdx, qword [rbp + 0xf38]
lea rcx, [rbp + 0x88]
call fcn.140011253
mov byte [rbp + 0xaa4], al
lea rcx, [rbp + 0xac8]
call fcn.1400111a4
movzx eax, byte [rbp + 0xaa4]
test eax, eax
je 0x14001961b
lea rax, [rbp + 0xb08]
mov qword [rbp + 0xb48], rax
lea rdx, str.Loader_base
mov rcx, qword [rbp + 0xb48]
call fcn.1400113f7
mov qword [rbp + 0xf38], rax
mov r9d, 0xc8
mov r8d, 0x190
mov rdx, qword [rbp + 0xf38]
mov rcx, qword [0x14002d4c0]
call fcn.14001100f
mov rcx, qword [0x14002d4c0]
call fcn.1400118e3
mov r8d, 3
mov edx, 2
mov rcx, qword [0x14002d4c0]
call fcn.140011820
lea rdx, [0x140011965]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Username:
mov rcx, rax
call fcn.1400110ff
lea rdx, [0x140011415]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, 3
mov edx, 0xc
mov rcx, qword [0x14002d4c0]
call fcn.140011820
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140011500
lea rcx, [rbp + 8]
call fcn.14001121c
movzx eax, al
test eax, eax
jne 0x140018f8c
mov r8d, 4
mov edx, 2
mov rcx, qword [0x14002d4c0]
call fcn.140011820
lea rdx, [0x140011965]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Pass:
mov rcx, rax
call fcn.1400110ff
mov rcx, qword [0x14002d4c0]
call fcn.1400117ee
mov r8d, 4
mov edx, 8
mov rcx, qword [0x14002d4c0]
call fcn.140011820
lea rdx, [rbp + 0x48]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140011500
lea rcx, [rbp + 0x48]
call fcn.14001121c
movzx eax, al
test eax, eax
jne 0x140019009
mov rcx, qword [0x14002d4c0]
call fcn.1400117ee
lea rcx, [rbp + 0x168]
call fcn.1400118a7
nop
lea rcx, [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
test eax, eax
je 0x1400195e2
lea rdx, [rbp + 0xd4]
lea rcx, [rbp + 0x168]
call fcn.140011050
lea rcx, [rbp + 0x168]
call fcn.1400110c8
mov qword [rbp + 0xf38], rax
lea rcx, [rbp + 0x48]
call fcn.1400110c8
mov qword [rbp + 0xf40], rax
lea rcx, [rbp + 8]
call fcn.1400110c8
mov rcx, qword [rbp + 0xf38]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0xf40]
mov r9, rcx
mov r8, rax
lea rdx, str._check.php_username_spassword_shwid_s
lea rcx, [rbp + 0x1b0]
call fcn.14001182a
lea rax, [rbp + 0xb68]
mov qword [rbp + 0xba8], rax
lea rax, [rbp + 0xbc8]
mov qword [rbp + 0xc08], rax
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rbp + 0xba8]
call fcn.1400113f7
mov qword [rbp + 0xf38], rax
mov rax, qword [rbp + 0xf38]
mov qword [rbp + 0xf40], rax
lea rdx, str.yourwebsite.com
mov rcx, qword [rbp + 0xc08]
call fcn.1400113f7
mov qword [rbp + 0xf48], rax
mov r9, qword [rbp + 0xf40]
mov r8, qword [rbp + 0xf48]
lea rdx, [rbp + 0x3c8]
mov rcx, qword [0x14002d4c0]
call fcn.1400118f2
nop
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0x408]
lea rcx, [rbp + 0x3c8]
call fcn.140011497
nop
mov r9d, 2
mov r8d, 1
lea rdx, [rbp + 0x448]
lea rcx, [rbp + 0x3c8]
call fcn.140011497
nop
lea rdx, [0x140027ad4]
lea rcx, [rbp + 0x408]
call fcn.14001138e
movzx eax, al
test eax, eax
je 0x140019591
lea rdx, [0x140027ad4]
lea rcx, [rbp + 0x448]
call fcn.14001138e
movzx eax, al
test eax, eax
jne 0x1400191ec
lea rdx, [0x140027ad8]
lea rcx, [rbp + 0x448]
call fcn.14001138e
movzx eax, al
test eax, eax
je 0x140019564
lea rcx, [0x140027adc]
call qword [sym.imp.ucrtbased.dll_system]
mov rcx, qword [0x14002d4c0]
call fcn.140011230
mov rcx, qword [0x14002d4c0]
call fcn.1400118e3
mov r8d, 2
mov edx, 2
mov rcx, qword [0x14002d4c0]
call fcn.140011820
lea rdx, [0x140011965]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.1._Inject_1.dll
mov rcx, rax
call fcn.1400110ff
mov r8d, 3
mov edx, 2
mov rcx, qword [0x14002d4c0]
call fcn.140011820
lea rdx, [0x140011965]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.2._Inject_2.dll
mov rcx, rax
call fcn.1400110ff
call qword [sym.imp.ucrtbased.dll__getch]
mov dword [rbp + 0x484], eax
mov eax, dword [rbp + 0x484]
mov dword [rbp + 0xf34], eax
cmp dword [rbp + 0xf34], 0x31
je 0x1400192b8
cmp dword [rbp + 0xf34], 0x32
je 0x140019404
jmp 0x14001954b
lea rcx, [0x140027adc]
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xc28]
mov qword [rbp + 0xc68], rax
lea rax, [rbp + 0xc88]
mov qword [rbp + 0xcc8], rax
lea rdx, str.c:__1.dll
mov rcx, qword [rbp + 0xc68]
call fcn.1400113f7
mov qword [rbp + 0xf38], rax
mov rax, qword [rbp + 0xf38]
mov qword [rbp + 0xf40], rax
lea rdx, str.yourwebsite.com_1.dll
mov rcx, qword [rbp + 0xcc8]
call fcn.1400113f7
mov qword [rbp + 0xf48], rax
mov r8, qword [rbp + 0xf40]
mov rdx, qword [rbp + 0xf48]
mov rcx, qword [0x14002d4c0]
call fcn.1400116b8
movzx eax, al
test eax, eax
je 0x1400193d5
lea rax, [rbp + 0xce8]
mov qword [rbp + 0xd28], rax
lea rax, [rbp + 0xd48]
mov qword [rbp + 0xd88], rax
lea rdx, str.c:__1.dll
mov rcx, qword [rbp + 0xd28]
call fcn.1400113f7
mov qword [rbp + 0xf38], rax
mov rax, qword [rbp + 0xf38]
mov qword [rbp + 0xf40], rax
lea rdx, str.notepad.exe
mov rcx, qword [rbp + 0xd88]
call fcn.1400113f7
mov qword [rbp + 0xf48], rax
mov r8, qword [rbp + 0xf40]
mov rdx, qword [rbp + 0xf48]
mov rcx, qword [0x14002d4c0]
call fcn.1400110d7
lea rdx, str.1.dll_injected_into_notepad.exe
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110ff
jmp 0x1400193ff
xor r9d, r9d
lea r8, str.Loader_base
lea rdx, str.Couldnt_download_DLL.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 0x4a4], eax
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
jmp 0x14001954b
lea rcx, [0x140027adc]
call qword [sym.imp.ucrtbased.dll_system]
lea rax, [rbp + 0xda8]
mov qword [rbp + 0xde8], rax
lea rax, [rbp + 0xe08]
mov qword [rbp + 0xe48], rax
lea rdx, str.c:__2.dll
mov rcx, qword [rbp + 0xde8]
call fcn.1400113f7
mov qword [rbp + 0xf38], rax
mov rax, qword [rbp + 0xf38]
mov qword [rbp + 0xf40], rax
lea rdx, str.yourwebsite.com_2.dll
mov rcx, qword [rbp + 0xe48]
call fcn.1400113f7
mov qword [rbp + 0xf48], rax
mov r8, qword [rbp + 0xf40]
mov rdx, qword [rbp + 0xf48]
mov rcx, qword [0x14002d4c0]
call fcn.1400116b8
movzx eax, al
test eax, eax
je 0x140019521
lea rax, [rbp + 0xe68]
mov qword [rbp + 0xea8], rax
lea rax, [rbp + 0xec8]
mov qword [rbp + 0xf08], rax
lea rdx, str.c:__2.dll
mov rcx, qword [rbp + 0xea8]
call fcn.1400113f7
mov qword [rbp + 0xf38], rax
mov rax, qword [rbp + 0xf38]
mov qword [rbp + 0xf40], rax
lea rdx, str.notepad.exe
mov rcx, qword [rbp + 0xf08]
call fcn.1400113f7
mov qword [rbp + 0xf48], rax
mov r8, qword [rbp + 0xf40]
mov rdx, qword [rbp + 0xf48]
mov rcx, qword [0x14002d4c0]
call fcn.1400110d7
lea rdx, str.2.dll_injected
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110ff
jmp 0x14001954b
xor r9d, r9d
lea r8, str.Loader_base
lea rdx, str.Couldnt_download_DLL.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 0x4c4], eax
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x14001958f
xor r9d, r9d
lea r8, str.Loader_base
lea rdx, str.Wrong_HWID.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 0x4e4], eax
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x1400195bc
xor r9d, r9d
lea r8, str.Loader_base
lea rdx, str.Wrong_password.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 0x504], eax
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp + 0x448]
call fcn.1400111a4
lea rcx, [rbp + 0x408]
call fcn.1400111a4
lea rcx, [rbp + 0x3c8]
call fcn.1400111a4
jmp 0x14001960d
xor r9d, r9d
lea r8, str.Loader_base
lea rdx, str.Couldnt_read_hwid.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 0x524], eax
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp + 0x168]
call fcn.1400111a4
jmp 0x140019646
xor r9d, r9d
lea r8, str.Loader_base
lea rdx, str.There_is_a_new_version_avaiable__please_download_it.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 0x544], eax
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov dword [rbp + 0xf24], 0
lea rcx, [rbp + 0x88]
call fcn.1400111a4
lea rcx, [rbp + 0x48]
call fcn.1400111a4
lea rcx, [rbp + 8]
call fcn.1400111a4
mov eax, dword [rbp + 0xf24]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140027300]
call fcn.140011749
mov rax, rdi
mov rcx, qword [rbp + 0xf50]
xor rcx, rbp
call fcn.140011456
lea rsp, [rbp + 0xf68]
pop rdi
pop rbp
ret