Function at 0x140002310
Capabilities:
Check for debugger via api
Create process on windows
Create process suspended
Create thread
Inject thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x40], rax
lea rdx, str.__Bienvenue_dans_le_crackme__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
mov rcx, rax
lea rdx, [0x1400039a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.________________________________________________________________________________________________________________________________________________________________________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
mov rcx, rax
lea rdx, [0x1400039a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__88888888888_888____888_8888888b.__8888888888________d8888_8888888b.__8888888888_8888888b._______8888888b.__8888888888_.d8888b.__8888888888_8888888b._88888888888_8888888_.d88888b.__888b____888_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
lea rdx, str.______888_____888____888_888___Y88b_888______________d88888_888___Y88b_888________888___Y88b______888___Y88b_888_______d88P__Y88b_888________888___Y88b____888_______888__d88P___Y88b_8888b___888_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
lea rdx, str.______888_____888____888_888____888_888_____________d88P888_888____888_888________888____888______888____888_888_______888____888_888________888____888____888_______888__888_____888_88888b__888_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
lea rdx, str.______888_____8888888888_888___d88P_8888888________d88P_888_888____888_8888888____888____888______888____888_8888888___888________8888888____888___d88P____888_______888__888_____888_888Y88b_888_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
lea rdx, str.______888_____888____888_8888888P___888___________d88P__888_888____888_888________888____888______888____888_888_______888________888________8888888P______888_______888__888_____888_888_Y88b888_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
lea rdx, str.______888_____888____888_888_T88b___888__________d88P___888_888____888_888________888____888______888____888_888_______888____888_888________888___________888_______888__888_____888_888__Y88888_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
lea rdx, str.______888_____888____888_888__T88b__888_________d8888888888_888.d88P___888________888.d88P________888.d88P___888_______Y88b__d88P_888________888___________888_______888__Y88b..d88P__888___Y8888_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
lea rdx, str.______888_____888____888_888___T88b_8888888888_d88P_____888_8888888P___8888888888_8888888P________8888888P___8888888888__Y8888P___8888888888_888___________888_____8888888__Y88888P___888____Y888_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
lea rdx, str.________________________________________________________________________________________________________________________________________________________________________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
mov rcx, rax
lea rdx, [0x1400039a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__Indice:_CreateProcess__Dev_par_sadmiata_pour_le_discord_danda_pirate__bonne_chance__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400024c9
mov r9d, 0x30
lea r8, str.Alerte_D
lea rdx, str.Oh_l
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, str.___Dbogage_dtect__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400037d0
mov rcx, rax
lea rdx, [0x1400039a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400046c0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r15d, r15d
mov dword [rsp + 0x68], r15d
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x68], 1
jne 0x140002503
lea r9d, [r15 + 0x30]
lea r8, str.Alerte_D
lea rdx, str.Un_d
jmp 0x140002470
call fcn.1400012b0
test al, al
je 0x140002478
call fcn.1400019d0
test al, al
je 0x140002478
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], r15b
lea rdx, str.__Entrez_le_mot_de_passe:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400037d0
lea rdx, [rbp - 0x78]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400039e0
cmp qword [rbp - 0x68], 0x12
jbe 0x14000258b
lea rdx, str.__Le_mot_de_passe_ne_doit_pas_dpasser_18_caractres.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400037d0
mov rcx, rax
lea rdx, [0x1400039a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edi, 1
jmp 0x140002933
mov dword [rbp - 0x30], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
lea rdx, str.ThreadedDeception.exe
lea rcx, [rbp - 0x58]
call fcn.1400030e0
nop
xorps xmm0, xmm0
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rdx, qword [rbp - 0x58]
mov rax, qword [rbp - 0x48]
lea rsi, [rdx + rax*2]
lea rdi, [rbp - 0x58]
cmova rdi, qword [rbp - 0x58]
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
sub rsi, rdi
mov rax, rsi
sar rax, 1
mov rbx, r15
je 0x140002675
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x14000297e
lea rbx, [rax + rax]
cmp rbx, 0x1000
jb 0x140002644
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140002978
call fcn.1400046e0
mov rcx, rax
test rax, rax
je 0x1400028ce
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002656
test rbx, rbx
je 0x140002653
mov rcx, rbx
call fcn.1400046e0
jmp 0x140002656
mov rax, r15
mov qword [rsp + 0x70], rax
add rbx, rax
mov qword [rbp - 0x80], rbx
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x78], rbx
mov word [rsp + 0x68], r15w
lea r8, [rsp + 0x68]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140003ff0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rsi, qword [rsp + 0x70]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, 1
test eax, eax
jne 0x140002711
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Erreur_lors_de_la_cration_du_processus_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400037d0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400039a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000289a
mov rbx, qword [rbp - 0x68]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
lea r8, [rbx + 1]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
jne 0x140002784
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Erreur_lors_de_lallocation_de_mmoire_dans_le_processus_cible_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400037d0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400039a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14000289a
lea r8, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova r8, qword [rbp - 0x78]
mov qword [rsp + 0x20], r15
lea r9, [rbx + 1]
mov rdx, r14
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400027bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Erreur_lors_de_lcriture_de_la_mmoire_dans_le_processus_cible_:
jmp 0x1400027f7
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
lea r9, [0x140001e10]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
jne 0x140002846
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Erreur_lors_de_la_cration_du_thread_distant_:
mov ebx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400037d0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400039a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14000289a
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r15d
test rsi, rsi
je 0x1400028de
mov rax, qword [rbp - 0x80]
sub rax, rsi
sar rax, 1
lea rdx, [rax + rax]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400028d5
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400047ec
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x140002921
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000291c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000291c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400047ec
movdqa xmm0, xmmword [0x140007220]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r15w
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140002971
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000296c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000296c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400047ec
mov eax, edi
jmp 0x1400024a0
call fcn.140001110
int3
call fcn.140004610
int3