Function at 0x1400112f3
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
jmp 0x140012540
push rbp
push rdi
sub rsp, 0x728
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x12e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x6e0], rax
lea rcx, [0x1400250f8]
call fcn.14001141f
nop
call qword [sym.imp.KERNEL32.dll_AllocConsole]
nop
lea rdx, str.InvSpoofer_Automator_started...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
mov qword [rbp + 0x6d8], rax
lea rdx, [0x14001103c]
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.InvSpoofer.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rdx, str.InvSpoofer.exe_opened...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
mov qword [rbp + 0x6d8], rax
lea rdx, [0x14001103c]
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, str.Administrator:_23Shop.xyz
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rbp + 8], rax
lea rdx, str.InvSpoofer_window_found...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
mov qword [rbp + 0x6d8], rax
lea rdx, [0x14001103c]
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
cmp qword [rbp + 8], 0
jne 0x14001269c
lea rdx, str.Error:_Could_not_find_InvSpoofer_window
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
mov qword [rbp + 0x6d8], rax
lea rdx, [0x14001103c]
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov eax, 1
jmp 0x1400129eb
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
nop
lea rdx, str.Focus_set_to_InvSpoofer_window...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
mov qword [rbp + 0x6d8], rax
lea rdx, [0x14001103c]
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
xor eax, eax
cmp eax, 1
je 0x140012717
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov r8d, 0x100
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowTextA]
nop
lea rdx, str.LOGIN
lea rcx, [rbp + 0x30]
call fcn.1400111d6
test rax, rax
je 0x140012715
jmp 0x140012717
jmp 0x1400126d6
lea rdx, str.LOGIN_keyword_found__pasting_LOGIN...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
mov qword [rbp + 0x6d8], rax
lea rdx, [0x14001103c]
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea r9, str.LOGIN
xor r8d, r8d
mov edx, 0xc
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SendMessageA]
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xd
call qword [sym.imp.USER32.dll_keybd_event]
nop
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov cl, 0xd
call qword [sym.imp.USER32.dll_keybd_event]
nop
xor eax, eax
cmp eax, 1
je 0x1400127cc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov r8d, 0x100
lea rdx, [rbp + 0x150]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowTextA]
nop
lea rdx, str.Username
lea rcx, [rbp + 0x150]
call fcn.1400111d6
test rax, rax
je 0x1400127ca
jmp 0x1400127cc
jmp 0x140012785
lea rdx, str.Username_keyword_found__pasting_mf0057...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
mov qword [rbp + 0x6d8], rax
lea rdx, [0x14001103c]
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea r9, str.mf0057
xor r8d, r8d
mov edx, 0xc
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SendMessageA]
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xd
call qword [sym.imp.USER32.dll_keybd_event]
nop
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov cl, 0xd
call qword [sym.imp.USER32.dll_keybd_event]
nop
xor eax, eax
cmp eax, 1
je 0x140012881
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov r8d, 0x100
lea rdx, [rbp + 0x270]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowTextA]
nop
lea rdx, str.Password
lea rcx, [rbp + 0x270]
call fcn.1400111d6
test rax, rax
je 0x14001287f
jmp 0x140012881
jmp 0x14001283a
lea rdx, str.Password_keyword_found__pasting_HcJkwBDXbb2Zg0h...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
mov qword [rbp + 0x6d8], rax
lea rdx, [0x14001103c]
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea r9, str.HcJkwBDXbb2Zg0h
xor r8d, r8d
mov edx, 0xc
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SendMessageA]
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xd
call qword [sym.imp.USER32.dll_keybd_event]
nop
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov cl, 0xd
call qword [sym.imp.USER32.dll_keybd_event]
nop
xor eax, eax
cmp eax, 1
je 0x140012936
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov r8d, 0x100
lea rdx, [rbp + 0x390]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowTextA]
nop
lea rdx, str.PERM
lea rcx, [rbp + 0x390]
call fcn.1400111d6
test rax, rax
je 0x140012934
jmp 0x140012936
jmp 0x1400128ef
lea rdx, str.PERM_keyword_found__pasting_PERM...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
mov qword [rbp + 0x6d8], rax
lea rdx, [0x14001103c]
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea r9, str.PERM
xor r8d, r8d
mov edx, 0xc
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SendMessageA]
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xd
call qword [sym.imp.USER32.dll_keybd_event]
nop
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov cl, 0xd
call qword [sym.imp.USER32.dll_keybd_event]
nop
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_PostMessageA]
nop
lea rdx, str.InvSpoofer_window_closed...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
mov qword [rbp + 0x6d8], rax
lea rdx, [0x14001103c]
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001bcd0]
call fcn.1400113ac
mov rax, rdi
mov rcx, qword [rbp + 0x6e0]
xor rcx, rbp
call fcn.140011217
lea rsp, [rbp + 0x6f8]
pop rdi
pop rbp
ret