Function at 0x140011150
Capabilities:
Create thread
Encode data using xor
Execute command
Hide graphical window
Log keystrokes via polling
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x140093080]
xor rax, rsp
mov qword [rbp + 0x27], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor r12d, r12d
mov word [rbp - 0x49], r12w
lea rcx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x140011000]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x140094010]
call fcn.14001f280
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs r13, 0x7fffffffffffffff
call fcn.140011040
lea rdx, str._n_n_nFN_PHORSAN
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012490
mov rcx, rax
lea rdx, [0x1400126b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._n_n_nPassword:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012490
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x21], 0
lea rdx, [rbp - 0x21]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400126f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r12
lea r14, [rbp - 0x21]
mov rsi, qword [rbp - 0x21]
mov r15, qword [rbp - 9]
cmp r15, 0x10
cmovae r14, rsi
mov rdi, qword [rbp - 0x11]
cmp rdi, r13
ja 0x140011a3f
mov qword [rbp - 0x29], reloc.WS2_32.dll_ntohs
cmp rdi, 0x10
jae 0x1400112b7
mov qword [rbp - 0x31], rdi
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x41], xmm0
jmp 0x140011349
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x1400112d6
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400112fd
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14001131f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140011413
mov rcx, rax
call fcn.140074bc0
mov rcx, rax
test rax, rax
je 0x14001140c
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001132e
test rcx, rcx
je 0x14001132b
call fcn.140074bc0
jmp 0x14001132e
mov rax, r12
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp - 0x41]
lea rcx, [0x140094010]
nop
nop
nop
nop
nop
cmp byte [0x140094228], 0
jmp 0x140011419
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400021a0
int3
mov edx, 0x1f4
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140011040
nop
cmp r15, 0x10
jb 0x140011469
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140011461
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011461
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140074f1c
mov eax, dword [str._UI_]
mov dword [rbp - 0x49], eax
mov edx, Ordinal_33
cmp byte [0x1400875fb], 0
je 0x140011560
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14001151b
movdqa xmm3, xmmword [0x1400883c0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140088410]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140088410]
shufps xmm2, xmm0, 0xdd
mov ecx, 4
movd xmm0, ecx
psrad xmm2, xmm0
movd xmm0, edx
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1400883e0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400883f0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.8888888888888888O]
movd xmm0, eax
pxor xmm2, xmm0
movd dword [rbp - 0x49], xmm2
jmp 0x140011560
lea r9, [rbp - 0x49]
mov r8d, r12d
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140011530
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x14000fa50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x14000faa0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x140011020]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], 1
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov word [rbp + 7], 0x5b
mov edi, reloc.WS2_32.dll_ntohs
mov ebx, 0x64
mov r15d, ebx
nop dword [rax]
mov r8d, 1
lea rdx, [0x14008749c]
lea rcx, [rbp + 7]
call fcn.140011dc0
mov eax, 0x88888889
imul r15d
lea r14d, [r15 + rdx]
sar r14d, 3
mov eax, r14d
shr eax, 0x1f
add r14d, eax
cmp r14d, 0x64
cmovg r14d, ebx
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r12
cmp rdi, r13
ja 0x140011a39
mov qword [rbp - 0x29], reloc.WS2_32.dll_ntohs
cmp rdi, 0x10
jae 0x14001167c
mov qword [rbp - 0x31], rdi
mov r8, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp - 0x41]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + rdi - 0x41], 0
jmp 0x140011718
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001169b
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400116c2
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400116e1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140011a22
mov rcx, rax
call fcn.140074bc0
test rax, rax
je 0x140011a28
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400116f3
test rcx, rcx
je 0x1400116f0
call fcn.140074bc0
mov rsi, rax
jmp 0x1400116f3
mov rsi, r12
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rbx
mov r8, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov byte [rsi + rdi], 0
mov ebx, 0x64
lea rdx, reloc.WS2_32.dll_listen
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012490
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
mov r8, qword [rbp + 0x17]
mov rcx, rax
call fcn.140013030
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae rdx, qword [rbp - 0x41]
mov r8, qword [rbp - 0x31]
mov rcx, rax
call fcn.140013030
lea rdx, [0x1400874a4]
mov rcx, rax
call fcn.140012490
mov rcx, rax
mov edx, r14d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x1400874a0]
call fcn.140012490
mov rcx, rax
lea rdx, [0x1400122e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 0x10
jb 0x1400117d5
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400117d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a28
call fcn.140074f1c
mov qword [rbp - 0x49], __WSAFDIsSet
lea rcx, [rbp - 0x49]
call fcn.140012300
add r15d, 0x64
dec rdi
cmp r15d, 0x640
jle 0x140011600
lea rdx, str._nConnecting_to_API
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012490
mov rcx, rax
lea rdx, [0x1400126b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140011040
lea rdx, str.___________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012490
mov rcx, rax
lea rdx, [0x1400126b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.F1_TO_SPOOF
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012490
mov rcx, rax
lea rdx, [0x1400126b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.___________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012490
mov rcx, rax
lea rdx, [0x1400126b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400126b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012490
mov rcx, rax
lea rdx, [0x1400126b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.F2_TO_CHECK_SERIALS
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012490
mov rcx, rax
lea rdx, [0x1400126b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012490
mov rcx, rax
lea rdx, [0x1400126b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, reloc.WS2_32.dll_WSASetLastError
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140011964
mov ecx, WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140011a2f
mov ecx, reloc.WS2_32.dll_WSASetLastError
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140011942
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140002410
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140074bc0
mov rdi, rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x11], Ordinal_26
mov qword [rbp - 9], Ordinal_33
movups xmm0, xmmword [0x140087518]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140087528]
movsd qword [rax + 0x10], xmm0
movzx ecx, byte [reloc.WS2_32.dll_ioctlsocket]
mov byte [rax + 0x18], cl
lea rsi, [rax + 0x19]
mov byte [rsi], 0
mov dword [rbp - 1], reloc.WLDAP32.dll_Ordinal_50
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rbx, rax
cmp rax, rsi
je 0x140011a10
mov qword [rbp - 0x49], reloc.WLDAP32.dll_Ordinal_50
movzx edx, byte [rbx]
mov rcx, r14
call fcn.140012120
mov rcx, rax
lea rdx, [0x1400122e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x49]
call fcn.140012300
inc rbx
cmp rbx, rsi
jne 0x1400119e4
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rdi
call fcn.140074f1c
jmp 0x140011820
call fcn.1400021a0
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003cb0
jmp 0x140011820
call fcn.140002240
nop
call fcn.140002240
int3