Function at 0x180004d70
Capabilities:
Encrypt or decrypt via wincrypt
Enumerate threads
Get hostname

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x180045028]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, qword [rsp + 0xe0]
mov r15, rcx
lea rcx, str.____._n
mov ebp, r8d
mov r14, r9
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180004dc7
lea rcx, str.____._n
call fcn.180001120
lea rcx, str.____n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180004de4
lea rcx, str.____n
call fcn.180001120
lea rcx, str.___._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180004e01
lea rcx, str.___._n
call fcn.180001120
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180004e26
lea rcx, str.Error_creating_thread_snapshot
call fcn.180013b6c
jmp 0x180004ebd
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x180004e60
lea rcx, str.Error_getting_first_thread
call fcn.180013b6c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
lea rcx, str.Thread_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180004e81
mov edx, dword [rsp + 0x40]
lea rcx, str.Thread_ID:__lu_n
call fcn.180001120
lea rcx, str.Owner_Process_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180004ea2
mov edx, dword [rsp + 0x44]
lea rcx, str.Owner_Process_ID:__lu_n
call fcn.180001120
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180004e60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Perch_se_perdonate_agli_uomini_le_loro_colpe__anche_il_Padre_vostro_celeste_perdoner_a_voi._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180004eda
lea rcx, str.Perch_se_perdonate_agli_uomini_le_loro_colpe__anche_il_Padre_vostro_celeste_perdoner_a_voi._n
call fcn.180001120
lea rcx, str.The_area_of_the_triangle_with_base__lf_and_height__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsd xmm6, qword [0x18003f158]
test eax, eax
jns 0x180004f1c
movsd xmm3, qword [0x18003f148]
lea rcx, str.The_area_of_the_triangle_with_base__lf_and_height__lf_is:__lf_n
movq r9, xmm3
movaps xmm2, xmm6
movq r8, xmm6
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.180001120
lea rcx, [0x18003e130]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180004f39
lea rcx, [0x18003e130]
call fcn.180001120
lea rcx, str.Eu_sou_a_videira__vocs_so_os_ramos._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180004f56
lea rcx, str.Eu_sou_a_videira__vocs_so_os_ramos._n
call fcn.180001120
lea rcx, str.Heureux_les_pauvres_en_esprit__car_le_royaume_des_cieux_est__eux._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180004f73
lea rcx, str.Heureux_les_pauvres_en_esprit__car_le_royaume_des_cieux_est__eux._n
call fcn.180001120
mov rcx, rbp
mov rbx, rbp
call fcn.180015bf4
lea rcx, str.________________n
mov qword [r14], rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180004f9e
lea rcx, str.________________n
call fcn.180001120
lea rcx, str.Je_suis_le_chemin__la_vrit_et_la_vie._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180004fbb
lea rcx, str.Je_suis_le_chemin__la_vrit_et_la_vie._n
call fcn.180001120
lea rcx, str.__________._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180004fd8
lea rcx, str.__________._n
call fcn.180001120
mov rdi, qword [r14]
test rdi, rdi
je 0x1800053ab
xor eax, eax
mov rcx, rbx
rep stosb byte [rdi], al
lea rcx, str.____n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180005008
lea rcx, str.____n
call fcn.180001120
lea rcx, str.The_maximum_number_between__d_and__d_is__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180005033
mov r9d, 0x14
lea rcx, str.The_maximum_number_between__d_and__d_is__d_n
mov r8d, r9d
mov edx, 0xf
call fcn.180001120
lea rcx, str.Hola__mundo__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180005050
lea rcx, str.Hola__mundo__n
call fcn.180001120
mov rcx, qword [r14]
test ebp, ebp
je 0x180005085
test rcx, rcx
je 0x180005075
mov r8, rbx
test rsi, rsi
je 0x18000506e
mov rdx, rsi
call fcn.180010580
jmp 0x180005085
xor edx, edx
call fcn.180010c30
call fcn.180015a94
mov dword [rax], 0x16
call fcn.1800142b0
lea rcx, [0x18003e358]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800050a2
lea rcx, [0x18003e358]
call fcn.180001120
lea rcx, [0x18003dce0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800050bf
lea rcx, [0x18003dce0]
call fcn.180001120
lea rcx, str.No_se_preocupem_com_o_amanh__pois_o_amanh_se_preocupar_consigo_mesmo._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800050dc
lea rcx, str.No_se_preocupem_com_o_amanh__pois_o_amanh_se_preocupar_consigo_mesmo._n
call fcn.180001120
lea rcx, [0x18003dc50]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800050f9
lea rcx, [0x18003dc50]
call fcn.180001120
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x10
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x180005139
lea rcx, str.Computer_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180005156
lea rdx, [rsp + 0x58]
lea rcx, str.Computer_Name:__s_n
call fcn.180001120
jmp 0x180005156
lea rcx, str.Failed_to_get_computer_name__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180005156
lea rcx, str.Failed_to_get_computer_name__n
call fcn.180001120
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 0x10
lea rdx, [rsp + 0x38]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
je 0x18000519b
lea rcx, str.Domain_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800051b8
lea rdx, [rsp + 0x38]
lea rcx, str.Domain_Name:__s_n
call fcn.180001120
jmp 0x1800051b8
lea rcx, str.Failed_to_get_domain_name__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800051b8
lea rcx, str.Failed_to_get_domain_name__n
call fcn.180001120
lea rcx, str.The_volume_of_the_cylinder_with_radius__lf_and_height__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800051f2
movsd xmm3, qword [0x18003f160]
lea rcx, str.The_volume_of_the_cylinder_with_radius__lf_and_height__lf_is:__lf_n
movq r9, xmm3
movaps xmm2, xmm6
movq r8, xmm6
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.180001120
mov dword [rsp + 0x34], ebp
mov ebx, 1
nop dword [rax + rax]
mov edi, 1
mov esi, ebx
nop word [rax + rax]
lea rcx, str._d___d___d
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180005235
mov r9d, esi
lea rcx, str._d___d___d
mov r8d, ebx
mov edx, edi
call fcn.180001120
inc edi
add esi, ebx
cmp edi, ebx
jle 0x180005210
lea rcx, [0x18003e6e0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000525a
lea rcx, [0x18003e6e0]
call fcn.180001120
inc ebx
cmp ebx, 9
jle 0x180005200
lea rcx, str.I_am_the_vine__you_are_the_branches._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000527e
lea rcx, str.I_am_the_vine__you_are_the_branches._n
call fcn.180001120
lea rcx, str.Ecco__io_sono_con_voi_tutti_i_giorni__fino_alla_fine_del_mondo._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000529b
lea rcx, str.Ecco__io_sono_con_voi_tutti_i_giorni__fino_alla_fine_del_mondo._n
call fcn.180001120
xor r9d, r9d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor edx, edx
mov rax, qword [r14]
mov rcx, r15
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1800053ab
lea rcx, str.Sum_of__d_and__d_is__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800052f1
mov edx, 5
lea rcx, str.Sum_of__d_and__d_is__d_n
lea r9d, [rdx + 3]
lea r8d, [rdx - 2]
call fcn.180001120
lea rcx, str.____._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000530e
lea rcx, str.____._n
call fcn.180001120
lea rcx, str.___._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000532b
lea rcx, str.___._n
call fcn.180001120
mov eax, dword [rsp + 0x34]
lea rcx, str.A_paz_eu_deixo_com_vocs__a_minha_paz_eu_dou_a_vocs._n
mov dword [r12], eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180005350
lea rcx, str.A_paz_eu_deixo_com_vocs__a_minha_paz_eu_dou_a_vocs._n
call fcn.180001120
lea rcx, str.Eu_sou_o_Alfa_e_o_mega__o_Primeiro_e_o_ltimo__o_Princpio_e_o_Fim._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000536d
lea rcx, str.Eu_sou_o_Alfa_e_o_mega__o_Primeiro_e_o_ltimo__o_Princpio_e_o_Fim._n
call fcn.180001120
lea rcx, str.The_area_of_the_triangle_with_base__lf_and_height__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800053a7
movsd xmm3, qword [0x18003f148]
lea rcx, str.The_area_of_the_triangle_with_base__lf_and_height__lf_is:__lf_n
movq r9, xmm3
movaps xmm2, xmm6
movq r8, xmm6
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.180001120
mov al, 1
jmp 0x1800053ad
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18000eae0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret