Function at 0x180010f60
Capabilities:
Access the windows event log
Check os version
Contain obfuscated stackstrings
Enumerate processes
Enumerate threads
Get hostname
Get mac address on windows
Get system information on windows
List tcp connections and listeners
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push r12
push r13
push r14
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov rax, qword [0x180053028]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov r13, rcx
lea rcx, str.Decimal_integer:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180010fae
mov edx, 0x3039
lea rcx, str.Decimal_integer:__d_n
call fcn.180001120
xor r14d, r14d
mov qword [rsp + 0x410], rdi
xor r9d, r9d
mov dword [rbp + 0xc0], 0x1a8
lea r8, [rbp + 0xc0]
xor edx, edx
xor ecx, ecx
mov ebx, r14d
call qword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
je 0x1800110df
mov edi, 0x9c
nop word [rax + rax]
lea rcx, str.Display_Device:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011014
lea rdx, [rbp + 0xc4]
lea rcx, str.Display_Device:__s_n
call fcn.180001120
lea rcx, str.Display_Device_String:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011038
lea rdx, [rbp + 0xe4]
lea rcx, str.Display_Device_String:__s_n
call fcn.180001120
lea r8, [rbp - 0x70]
mov word [rbp - 0x4c], di
mov edx, 0xffffffff
lea rcx, [rbp + 0xc4]
call qword [sym.imp.USER32.dll_EnumDisplaySettingsA]
test eax, eax
je 0x18001109e
lea rcx, str.Display_Settings:__d_x__d___d_bit_color_depth_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18001107e
mov r9d, dword [rbp - 8]
lea rcx, str.Display_Settings:__d_x__d___d_bit_color_depth_n
mov r8d, dword [rbp]
mov edx, dword [rbp - 4]
call fcn.180001120
lea rcx, str.Display_Refresh_Rate:__d_Hz_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18001109e
mov edx, dword [rbp + 8]
lea rcx, str.Display_Refresh_Rate:__d_Hz_n
call fcn.180001120
lea rcx, str.Display_Device_State:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800110c1
mov edx, dword [rbp + 0x164]
lea rcx, str.Display_Device_State:__d_n
call fcn.180001120
inc ebx
lea r8, [rbp + 0xc0]
mov edx, ebx
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
jne 0x180010ff0
lea rcx, str.Character:__c_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011101
mov edx, 0x41
lea rcx, str.Character:__c_n
call fcn.180001120
lea rcx, str.Array_sum:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011123
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, str.Array_sum:__d_n
call fcn.180001120
lea rcx, str.Short_integer:__hd_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011145
mov edx, 0x7fff
lea rcx, str.Short_integer:__hd_n
call fcn.180001120
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.180014bf0
movzx ecx, word [rsp + 0x60]
test ecx, ecx
je 0x1800111d5
sub ecx, 5
je 0x1800111bb
sub ecx, 1
je 0x1800111a1
cmp ecx, 3
je 0x180011187
lea rcx, str.Unknown_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800111f2
lea rcx, str.Unknown_n
jmp 0x1800111ed
lea rcx, str.x64_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800111f2
lea rcx, str.x64_n
jmp 0x1800111ed
lea rcx, str.IA64_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800111f2
lea rcx, str.IA64_n
jmp 0x1800111ed
lea rcx, str.ARM_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800111f2
lea rcx, str.ARM_n
jmp 0x1800111ed
lea rcx, str.x86_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800111f2
lea rcx, str.x86_n
call fcn.180001120
lea rcx, str.Number_of_Processors:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011212
mov edx, dword [rbp - 0x80]
lea rcx, str.Number_of_Processors:__d_n
call fcn.180001120
lea rcx, str.Processor_Type:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011232
mov edx, dword [rbp - 0x7c]
lea rcx, str.Processor_Type:__d_n
call fcn.180001120
lea rcx, str.Processor_Level:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011253
movzx edx, word [rbp - 0x74]
lea rcx, str.Processor_Level:__d_n
call fcn.180001120
lea rcx, str.Processor_Revision:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011274
movzx edx, word [rbp - 0x72]
lea rcx, str.Processor_Revision:__d_n
call fcn.180001120
lea rcx, str.Long_long_integer:__lld_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18001129b
movabs rdx, 0x8000000000000000
lea rcx, str.Long_long_integer:__lld_n
call fcn.180001120
mov ebx, 0x64
mov eax, 0x51eb851f
mul ebx
mov eax, 0xcccccccd
mov r9d, edx
mul ebx
shr r9d, 5
mov eax, 0x66666667
mov ecx, edx
shr ecx, 3
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
mov edx, ecx
add eax, eax
sub edx, eax
lea eax, [rcx + rcx*4]
add eax, eax
mov ecx, ebx
sub ecx, eax
mov eax, edx
imul eax, edx
mov r8d, ecx
imul r8d, ecx
imul eax, edx
imul r8d, ecx
add r8d, eax
mov eax, r9d
imul eax, r9d
imul eax, r9d
add r8d, eax
cmp ebx, r8d
jne 0x180011325
lea rcx, str.Narcissistic_Number:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011325
mov edx, ebx
lea rcx, str.Narcissistic_Number:__d_n
call fcn.180001120
inc ebx
cmp ebx, 0x3e8
jl 0x1800112a0
xor ecx, ecx
call fcn.180020884
lea rcx, [rbp + 0x290]
mov qword [rbp + 0x290], rax
call fcn.180020be0
mov r9, rax
lea r8, str._Y__m__d__H:_M:_S
mov edx, 0x14
lea rcx, [rsp + 0x60]
call fcn.18001e084
lea rcx, str.Current_Time_3:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011388
lea rdx, [rsp + 0x60]
lea rcx, str.Current_Time_3:__s_n
call fcn.180001120
lea rcx, str.Sum_of__d_and__d_is__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800113b2
mov edx, 5
lea rcx, str.Sum_of__d_and__d_is__d_n
lea r9d, [rdx + 3]
lea r8d, [rdx - 2]
call fcn.180001120
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800113d7
lea rcx, str.Error_creating_process_snapshot
call fcn.18001db60
jmp 0x18001148b
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x180011410
lea rcx, str.Error_getting_first_process
call fcn.18001db60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax]
nop dword [rax + rax]
lea rcx, str.Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011430
mov edx, dword [rbp - 0x68]
lea rcx, str.Process_ID:__lu_n
call fcn.180001120
lea rcx, str.Parent_Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011450
mov edx, dword [rbp - 0x50]
lea rcx, str.Parent_Process_ID:__lu_n
call fcn.180001120
lea rcx, str.Process_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011471
lea rdx, [rbp - 0x44]
lea rcx, str.Process_Name:__s_n
call fcn.180001120
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180011410
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Pi:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800114b5
movsd xmm1, qword [0x18004d240]
lea rcx, str.Pi:__lf_n
movq rdx, xmm1
call fcn.180001120
lea rcx, [rbp + 0x270]
mov qword [rsp + 0x48], 0xb848
mov dword [rsp + 0x50], 0xe0ff0000
mov dword [rbp + 0x270], 0x6e72654b
mov dword [rbp + 0x274], 0x32336c65
mov dword [rbp + 0x278], 0x6c6c642e
mov byte [rbp + 0x27c], r14b
mov dword [rbp + 0x280], 0x74726956
mov dword [rbp + 0x284], 0x506c6175
mov dword [rbp + 0x288], 0x65746f72
mov word [rbp + 0x28c], 0x7463
mov byte [rbp + 0x28e], r14b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Key_State:__s_n
mov r12, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011578
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
lea rax, str.Pressed
lea rdx, str.Released
cmovb rdx, rax
lea rcx, str.Key_State:__s_n
call fcn.180001120
lea rcx, str.Quotient_of__d_and__d_is:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800115a2
mov edx, 0x64
lea rcx, str.Quotient_of__d_and__d_is:__d_n
lea r9d, [rdx - 0x4b]
lea r8d, [rdx - 0x60]
call fcn.180001120
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x10
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x1800115e6
lea rcx, str.Computer_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011603
lea rdx, [rbp + 0x290]
lea rcx, str.Computer_Name:__s_n
call fcn.180001120
jmp 0x180011603
lea rcx, str.Failed_to_get_computer_name__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011603
lea rcx, str.Failed_to_get_computer_name__n
call fcn.180001120
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 0x10
lea rdx, [rbp + 0x2a0]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
je 0x18001164c
lea rcx, str.Domain_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011669
lea rdx, [rbp + 0x2a0]
lea rcx, str.Domain_Name:__s_n
call fcn.180001120
jmp 0x180011669
lea rcx, str.Failed_to_get_domain_name__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011669
lea rcx, str.Failed_to_get_domain_name__n
call fcn.180001120
test r12, r12
je 0x180012335
mov qword [rsp + 0x408], rsi
lea rdx, [rsp + 0x40]
xor ecx, ecx
movaps xmmword [rsp + 0x3c0], xmm6
mov dword [rsp + 0x40], r14d
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x180011742
mov ecx, dword [rsp + 0x40]
call fcn.180020ffc
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x18001172c
mov rbx, rdi
test rdi, rdi
je 0x180011738
lea rcx, str.MAC_Address:__02X__02X__02X__02X__02X__02X_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18001171a
movzx ecx, byte [rbx + 0x19c]
movzx eax, byte [rbx + 0x19d]
movzx r10d, byte [rbx + 0x19b]
movzx r9d, byte [rbx + 0x19a]
movzx r8d, byte [rbx + 0x199]
movzx edx, byte [rbx + 0x198]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rcx, str.MAC_Address:__02X__02X__02X__02X__02X__02X_n
mov dword [rsp + 0x20], r10d
call fcn.180001120
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1800116c3
mov rcx, rdi
call fcn.180020c30
jmp 0x18001174e
lea rcx, str.Error_getting_MAC_address
call fcn.18001db60
mov rcx, rdi
call fcn.180020c30
jmp 0x18001174e
lea rcx, str.Error_getting_MAC_address
call fcn.18001db60
movdqa xmm0, xmmword [0x18004d2a0]
lea rcx, str.Array_elements:_n
movdqa xmm1, xmmword [0x18004d2b0]
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rbp - 0x80], 9
movdqu xmmword [rsp + 0x70], xmm1
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18001178e
lea rcx, str.Array_elements:_n
call fcn.180001120
mov rdi, r14
nop dword [rax]
nop word [rax + rax]
mov rbx, r14
lea rcx, [0x18004c408]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800117c8
lea rax, [rbx + rdi]
mov edx, dword [rsp + rax*4 + 0x60]
lea rcx, [0x18004c408]
call fcn.180001120
inc rbx
cmp rbx, 3
jl 0x1800117a3
lea rcx, [0x18004bd68]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800117ee
lea rcx, [0x18004bd68]
call fcn.180001120
add rdi, 3
cmp rdi, 9
jl 0x1800117a0
mov ecx, 0x1c
mov dword [rsp + 0x40], r14d
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x18001181b
lea rcx, str.Error_allocating_memory_needed_to_call_GetExtendedTcpTable
call fcn.18001db60
mov dword [rsp + 0x28], r14d
lea rdx, [rsp + 0x40]
mov r9d, 2
mov dword [rsp + 0x20], 5
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
cmp eax, 0x7a
jne 0x180011869
mov rcx, rsi
call fcn.180020c30
mov ecx, dword [rsp + 0x40]
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x180011869
lea rcx, str.Error_allocating_memory_needed_to_call_GetExtendedTcpTable
call fcn.18001db60
mov dword [rsp + 0x28], r14d
lea rdx, [rsp + 0x40]
mov r9d, 2
mov dword [rsp + 0x20], 5
xor r8d, r8d
mov qword [rsp + 0x418], r15
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
test eax, eax
jne 0x18001198c
mov r15d, r14d
cmp dword [rsi], r14d
jbe 0x18001199d
nop dword [rax]
lea rcx, str.Local_Address:__s:_u_n
mov r14d, r15d
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800118f2
lea rdi, [r14 + r14*2]
movzx ecx, word [rsi + rdi*8 + 0xc]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [rsi + rdi*8 + 8]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8d, ebx
lea rcx, str.Local_Address:__s:_u_n
mov rdx, rax
call fcn.180001120
lea rcx, str.Remote_Address:__s:_u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011931
lea rdi, [r14 + r14*2]
movzx ecx, word [rsi + rdi*8 + 0x14]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [rsi + rdi*8 + 0x10]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8d, ebx
lea rcx, str.Remote_Address:__s:_u_n
mov rdx, rax
call fcn.180001120
lea rcx, str.State:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011956
lea rax, [r14 + r14*2]
mov edx, dword [rsi + rax*8 + 4]
lea rcx, str.State:__u_n
call fcn.180001120
lea rcx, str.PID:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18001197b
lea rax, [r14 + r14*2]
mov edx, dword [rsi + rax*8 + 0x18]
lea rcx, str.PID:__u_n
call fcn.180001120
inc r15d
cmp r15d, dword [rsi]
jb 0x1800118b0
xor r14d, r14d
jmp 0x18001199d
lea rcx, str.GetExtendedTcpTable_failed_with_error
call fcn.18001db60
test rsi, rsi
je 0x1800119a5
mov rcx, rsi
call fcn.180020c30
lea rcx, str.Product_of__d_and__d_is:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r15, qword [rsp + 0x418]
mov rsi, qword [rsp + 0x408]
test eax, eax
jns 0x1800119df
mov edx, 5
lea rcx, str.Product_of__d_and__d_is:__d_n
lea r9d, [rdx + 0x19]
lea r8d, [rdx + 1]
call fcn.180001120
lea rdx, [rbp + 0x290]
mov dword [rbp + 0x290], 0x10
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x180011a27
lea rcx, str.Computer_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011a44
lea rdx, [rbp + 0x2a0]
lea rcx, str.Computer_Name:__s_n
call fcn.180001120
jmp 0x180011a44
lea rcx, str.Failed_to_get_computer_name__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011a44
lea rcx, str.Failed_to_get_computer_name__n
call fcn.180001120
lea r8, [rbp + 0x290]
mov dword [rbp + 0x290], 0x10
lea rdx, [rsp + 0x60]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
je 0x180011a8d
lea rcx, str.Domain_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011aaa
lea rdx, [rsp + 0x60]
lea rcx, str.Domain_Name:__s_n
call fcn.180001120
jmp 0x180011aaa
lea rcx, str.Failed_to_get_domain_name__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011aaa
lea rcx, str.Failed_to_get_domain_name__n
call fcn.180001120
lea rcx, str.The_minimum_number_between__d_and__d_is__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011ad3
mov edx, 0x19
lea rcx, str.The_minimum_number_between__d_and__d_is__d_n
mov r9d, edx
lea r8d, [rdx + 5]
call fcn.180001120
mov edx, reloc.WS2_32.dll_inet_ntoa
lea r9, [rsp + 0x58]
mov rcx, r13
lea r8d, [rdx + 0x34]
call r12
lea rcx, str.The_height_of_the_equilateral_triangle_with_side__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsd xmm6, qword [0x18004d228]
test eax, eax
jns 0x180011b40
xorps xmm0, xmm0
ucomisd xmm0, xmm6
ja 0x180011b0f
sqrtpd xmm0, xmm6
jmp 0x180011b17
movaps xmm0, xmm6
call fcn.18003ae3c
mulsd xmm0, qword [0x18004d200]
lea rcx, str.The_height_of_the_equilateral_triangle_with_side__lf_is:__lf_n
movsd xmm1, qword [0x18004d210]
movq rdx, xmm1
movaps xmm2, xmm0
movq r8, xmm0
call fcn.180001120
lea rcx, str.The_volume_of_the_sphere_with_radius__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011b8a
movsd xmm0, qword [0x18004d210]
movaps xmm1, xmm6
call fcn.180023360
mulsd xmm0, qword [0x18004d250]
lea rcx, str.The_volume_of_the_sphere_with_radius__lf_is:__lf_n
movsd xmm1, qword [0x18004d210]
movq rdx, xmm1
movaps xmm2, xmm0
movq r8, xmm0
call fcn.180001120
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rcx, str.System_Uptime:__d_days___d_hours___d_minutes___d_seconds_n
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movaps xmm6, xmmword [rsp + 0x3c0]
test eax, eax
jns 0x180011c76
mov r10, rbx
movabs rdi, 0x179ec9cbd821dc3b
movabs rax, 0x8daea1d7f4cf721b
movabs r11, 0x4a90be587de6e565
mul rbx
mov rax, rdi
mov r9, rbx
sub r10, rdx
mov r8, rbx
shr r10, 1
add r10, rdx
mul rbx
mov rax, rbx
shr r10, 0x1a
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0xf
imul rax, rax, 0xea60
sub r9, rax
movabs rax, 0x624dd2f1a9fbe77
mul r9
mov rax, r11
sub r9, rdx
shr r9, 1
add r9, rdx
mul rbx
shr r9, 9
mov rax, rdi
shr rdx, 0x14
imul rcx, rdx, 0x36ee80
mov dword [rsp + 0x20], r9d
sub r8, rcx
mul r8
imul rcx, r10, 0x5265c00
sub r8, rdx
mov rax, r11
shr r8, 1
add r8, rdx
shr r8, 0xf
mov r9d, r8d
sub rbx, rcx
lea rcx, str.System_Uptime:__d_days___d_hours___d_minutes___d_seconds_n
mul rbx
shr rdx, 0x14
mov r8d, edx
mov edx, r10d
call fcn.180001120
lea rcx, [rbp + 0x290]
mov dword [rbp + 0x290], 8
mov ebx, r14d
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x180011cae
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
sub ecx, dword [rbp + 0x294]
mul ecx
mov ebx, edx
shr ebx, 6
lea rcx, str.Idle_Time:__d_seconds_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011ccd
mov edx, ebx
lea rcx, str.Idle_Time:__d_seconds_n
call fcn.180001120
movsd xmm0, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov eax, dword [rsp + 0x50]
movsd qword [r13], xmm0
mov dword [r13 + 8], eax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.Processor_Architecture:
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011d09
lea rcx, str.Processor_Architecture:
call fcn.180001120
movzx eax, word [rsp + 0x60]
test eax, eax
je 0x180011d6a
cmp eax, 5
je 0x180011d50
cmp eax, 9
je 0x180011d36
lea rcx, str.Unknown_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011d87
lea rcx, str.Unknown_n
jmp 0x180011d82
lea rcx, str.AMD64_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011d87
lea rcx, str.AMD64_n
jmp 0x180011d82
lea rcx, str.ARM_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011d87
lea rcx, str.ARM_n
jmp 0x180011d82
lea rcx, str.Intel_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011d87
lea rcx, str.Intel_n
call fcn.180001120
lea rcx, str.Number_of_Processors:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011da7
mov edx, dword [rbp - 0x80]
lea rcx, str.Number_of_Processors:__u_n
call fcn.180001120
xorps xmm0, xmm0
mov dword [rbp - 0x70], 0x94
lea rcx, [rbp - 0x70]
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x180011e0d
lea rcx, str.Operating_System_Version:__d._d__Build__d__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011e2a
mov r9d, dword [rbp - 0x64]
lea rcx, str.Operating_System_Version:__d._d__Build__d__n
mov r8d, dword [rbp - 0x68]
mov edx, dword [rbp - 0x6c]
call fcn.180001120
jmp 0x180011e2a
lea rcx, str.Failed_to_get_operating_system_version__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011e2a
lea rcx, str.Failed_to_get_operating_system_version__n
call fcn.180001120
lea rcx, str.Remainder_of__d_and__d_is:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011e54
mov edx, 0x11
lea rcx, str.Remainder_of__d_and__d_is:__d_n
lea r9d, [rdx - 0x10]
lea r8d, [rdx - 0xd]
call fcn.180001120
lea rax, [0x18000cd40]
xor ecx, ecx
lea rdx, str.Security
mov qword [r13 + 2], rax
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov rdi, rax
test rax, rax
je 0x180011fff
mov ecx, 0x10000
call fcn.180020ffc
mov rbx, rax
test rax, rax
je 0x180011fe8
xor r8d, r8d
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x290]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x10000
lea edx, [r8 + 5]
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
je 0x180011fd5
nop dword [rax]
nop dword [rax + rax]
lea rcx, str.Event_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011ef0
mov edx, dword [rbx + 0x14]
lea rcx, str.Event_ID:__lu_n
call fcn.180001120
lea rcx, str.Event_Type:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011f11
movzx edx, word [rbx + 0x18]
lea rcx, str.Event_Type:__lu_n
call fcn.180001120
lea rcx, str.Event_Category:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011f32
movzx edx, word [rbx + 0x1c]
lea rcx, str.Event_Category:__lu_n
call fcn.180001120
lea rcx, str.Time_Generated:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011f5b
lea rcx, [rbx + 0xc]
call fcn.180020f88
mov rdx, rax
lea rcx, str.Time_Generated:__s_n
call fcn.180001120
lea rcx, str.Source_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011f7e
mov edx, dword [rbx + 0x24]
lea rcx, str.Source_Name:__s_n
add rdx, rbx
call fcn.180001120
lea rcx, str.Event_String:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180011fa1
mov edx, dword [rbx + 0x34]
lea rcx, str.Event_String:__s_n
add rdx, rbx
call fcn.180001120
xor r8d, r8d
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x290]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x10000
lea edx, [r8 + 5]
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
jne 0x180011ed0
mov rcx, rbx
call fcn.180020c30
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x18001200b
lea rcx, str.Error_allocating_memory_for_event_log_record
call fcn.18001db60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x18001200b
lea rcx, str.Error_opening_event_log
call fcn.18001db60
lea rcx, str.Current_time:_07:38:26_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180012028
lea rcx, str.Current_time:_07:38:26_n
call fcn.180001120
lea rcx, str.Character:__c_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18001204a
mov edx, 0x41
lea rcx, str.Character:__c_n
call fcn.180001120
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov edx, reloc.WS2_32.dll_inet_ntoa
mov rcx, r13
call r12
lea rcx, str.Hexadecimal_integer:_0x_X_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180012081
mov edx, 0xabcd
lea rcx, str.Hexadecimal_integer:_0x_X_n
call fcn.180001120
lea rcx, str._______________________________n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18001209e
lea rcx, str._______________________________n
call fcn.180001120
lea rcx, str.Unsigned_long_integer:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800120c0
mov edx, 0xffffffff
lea rcx, str.Unsigned_long_integer:__lu_n
call fcn.180001120
lea rcx, str.Natural_Logarithm_of_10:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800120f2
movsd xmm0, qword [0x18004d270]
call fcn.18003a3a0
movaps xmm1, xmm0
lea rcx, str.Natural_Logarithm_of_10:__lf_n
movq rdx, xmm0
call fcn.180001120
lea rcx, str.Integer:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180012114
mov edx, 0x3039
lea rcx, str.Integer:__d_n
call fcn.180001120
lea rcx, str.Fibonacci_number_at_position__d_is__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18001213a
mov edx, 8
lea rcx, str.Fibonacci_number_at_position__d_is__d_n
lea r8d, [rdx + 0xd]
call fcn.180001120
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18001215f
lea rcx, str.Error_creating_thread_snapshot
call fcn.18001db60
jmp 0x1800121ed
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x1c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x180012190
lea rcx, str.Error_getting_first_thread
call fcn.18001db60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, str.Thread_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800121b1
mov edx, dword [rsp + 0x68]
lea rcx, str.Thread_ID:__lu_n
call fcn.180001120
lea rcx, str.Owner_Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800121d2
mov edx, dword [rsp + 0x6c]
lea rcx, str.Owner_Process_ID:__lu_n
call fcn.180001120
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180012190
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180012212
lea rcx, str.Error_creating_process_snapshot
call fcn.18001db60
jmp 0x1800122bb
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x180012240
lea rcx, str.Error_getting_first_process
call fcn.18001db60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, str.Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180012260
mov edx, dword [rbp - 0x68]
lea rcx, str.Process_ID:__lu_n
call fcn.180001120
lea rcx, str.Parent_Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180012280
mov edx, dword [rbp - 0x50]
lea rcx, str.Parent_Process_ID:__lu_n
call fcn.180001120
lea rcx, str.Process_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800122a1
lea rdx, [rbp - 0x44]
lea rcx, str.Process_Name:__s_n
call fcn.180001120
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180012240
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str._c_is_a_punctuation_mark._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800122dd
mov edx, 0x2c
lea rcx, str._c_is_a_punctuation_mark._n
call fcn.180001120
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, str.Current_Time_2:__d__d__d__d:_d:_d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180012335
movzx eax, word [rsp + 0x54]
lea rcx, str.Current_Time_2:__d__d__d__d:_d:_d_n
movzx r10d, word [rsp + 0x52]
movzx r11d, word [rsp + 0x50]
movzx r9d, word [rsp + 0x4e]
movzx r8d, word [rsp + 0x4a]
movzx edx, word [rsp + 0x48]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.180001120
mov rdi, qword [rsp + 0x410]
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.180018ca0
add rsp, 0x3d0
pop r14
pop r13
pop r12
pop rbx
pop rbp
ret