Function at 0x140001f40
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
movdqa xmm2, xmmword [0x140003700]
xor r14d, r14d
movdqa xmm0, xmmword [0x140003720]
mov ebx, r14d
movdqa xmm1, xmmword [str.Z8__f]
movdqu xmmword [rbp - 0x49], xmm2
mov ecx, dword [rbp - 0x41]
lea r15d, [r14 + 1]
mov dword [rbp - 0x19], 0x65
mov dword [rbp - 0x15], 0x41
mov dword [rbp - 0x11], 0x27
mov dword [rbp - 0x49], 0xc
movd dword [rbp - 0x45], xmm2
movdqu xmmword [rbp - 0x39], xmm0
movdqu xmmword [rbp - 0x29], xmm1
cmp ecx, 0x27
jge 0x140001fbc
lea rdx, [rbp - 0x45]
mov ebx, r15d
mov eax, dword [rdx]
mov dword [rdx], ecx
mov dword [rbp - 0x41], eax
mov edx, dword [rbp - 0x3d]
cmp edx, 0x27
jge 0x140001fd4
inc ebx
movsxd rax, ebx
mov ecx, dword [rbp + rax*4 - 0x49]
mov dword [rbp + rax*4 - 0x49], edx
mov dword [rbp - 0x3d], ecx
mov edx, dword [rbp - 0x39]
cmp edx, 0x27
jge 0x140001fec
inc ebx
movsxd rax, ebx
mov ecx, dword [rbp + rax*4 - 0x49]
mov dword [rbp + rax*4 - 0x49], edx
mov dword [rbp - 0x39], ecx
mov edx, dword [rbp - 0x35]
cmp edx, 0x27
jge 0x140002004
inc ebx
movsxd rax, ebx
mov ecx, dword [rbp + rax*4 - 0x49]
mov dword [rbp + rax*4 - 0x49], edx
mov dword [rbp - 0x35], ecx
mov edx, dword [rbp - 0x31]
cmp edx, 0x27
jge 0x14000201c
inc ebx
movsxd rax, ebx
mov ecx, dword [rbp + rax*4 - 0x49]
mov dword [rbp + rax*4 - 0x49], edx
mov dword [rbp - 0x31], ecx
mov edx, dword [rbp - 0x2d]
cmp edx, 0x27
jge 0x140002034
inc ebx
movsxd rax, ebx
mov ecx, dword [rbp + rax*4 - 0x49]
mov dword [rbp + rax*4 - 0x49], edx
mov dword [rbp - 0x2d], ecx
mov edx, dword [rbp - 0x29]
cmp edx, 0x27
jge 0x14000204c
inc ebx
movsxd rax, ebx
mov ecx, dword [rbp + rax*4 - 0x49]
mov dword [rbp + rax*4 - 0x49], edx
mov dword [rbp - 0x29], ecx
mov edx, dword [rbp - 0x25]
cmp edx, 0x27
jge 0x140002064
inc ebx
movsxd rax, ebx
mov ecx, dword [rbp + rax*4 - 0x49]
mov dword [rbp + rax*4 - 0x49], edx
mov dword [rbp - 0x25], ecx
mov edx, dword [rbp - 0x21]
cmp edx, 0x27
jge 0x14000207c
inc ebx
movsxd rax, ebx
mov ecx, dword [rbp + rax*4 - 0x49]
mov dword [rbp + rax*4 - 0x49], edx
mov dword [rbp - 0x21], ecx
mov edx, dword [rbp - 0x1d]
cmp edx, 0x27
jge 0x140002094
inc ebx
movsxd rax, ebx
mov ecx, dword [rbp + rax*4 - 0x49]
mov dword [rbp + rax*4 - 0x49], edx
mov dword [rbp - 0x1d], ecx
mov edx, dword [rbp - 0x19]
cmp edx, 0x27
jge 0x1400020ac
inc ebx
movsxd rax, ebx
mov ecx, dword [rbp + rax*4 - 0x49]
mov dword [rbp + rax*4 - 0x49], edx
mov dword [rbp - 0x19], ecx
mov edx, dword [rbp - 0x15]
cmp edx, 0x27
jge 0x1400020c4
inc ebx
movsxd rax, ebx
mov ecx, dword [rbp + rax*4 - 0x49]
mov dword [rbp + rax*4 - 0x49], edx
mov dword [rbp - 0x15], ecx
movsxd rax, ebx
lea rcx, [rbp - 0x45]
mov edx, dword [rcx + rax*4]
lea rcx, [rcx + rax*4]
mov eax, dword [rbp - 0x11]
mov r8d, ebx
mov dword [rcx], eax
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x11], edx
xor edx, edx
call fcn.140002be0
lea edx, [rbx + 2]
mov r8d, 0xe
lea rcx, [rbp - 0x49]
call fcn.140002be0
mov ecx, dword [rbp - 0x45]
mov ebx, r14d
cmp dword [rbp - 0x49], ecx
mov edx, dword [rbp - 0x41]
cmovne ebx, r15d
cmp ecx, edx
je 0x140002117
mov dword [rbp + rbx*4 - 0x49], ecx
inc ebx
mov edx, dword [rbp - 0x41]
mov ecx, dword [rbp - 0x3d]
cmp edx, ecx
je 0x140002127
mov dword [rbp + rbx*4 - 0x49], edx
inc ebx
mov ecx, dword [rbp - 0x3d]
mov edx, dword [rbp - 0x39]
cmp ecx, edx
je 0x140002137
mov dword [rbp + rbx*4 - 0x49], ecx
inc ebx
mov edx, dword [rbp - 0x39]
mov ecx, dword [rbp - 0x35]
cmp edx, ecx
je 0x140002147
mov dword [rbp + rbx*4 - 0x49], edx
inc ebx
mov ecx, dword [rbp - 0x35]
mov edx, dword [rbp - 0x31]
cmp ecx, edx
je 0x140002157
mov dword [rbp + rbx*4 - 0x49], ecx
inc ebx
mov edx, dword [rbp - 0x31]
mov ecx, dword [rbp - 0x2d]
cmp edx, ecx
je 0x140002167
mov dword [rbp + rbx*4 - 0x49], edx
inc ebx
mov ecx, dword [rbp - 0x2d]
mov edx, dword [rbp - 0x29]
cmp ecx, edx
je 0x140002177
mov dword [rbp + rbx*4 - 0x49], ecx
inc ebx
mov edx, dword [rbp - 0x29]
mov ecx, dword [rbp - 0x25]
cmp edx, ecx
je 0x140002187
mov dword [rbp + rbx*4 - 0x49], edx
inc ebx
mov ecx, dword [rbp - 0x25]
mov edx, dword [rbp - 0x21]
cmp ecx, edx
je 0x140002197
mov dword [rbp + rbx*4 - 0x49], ecx
inc ebx
mov edx, dword [rbp - 0x21]
mov ecx, dword [rbp - 0x1d]
cmp edx, ecx
je 0x1400021a7
mov dword [rbp + rbx*4 - 0x49], edx
inc ebx
mov ecx, dword [rbp - 0x1d]
mov edx, dword [rbp - 0x19]
cmp ecx, edx
je 0x1400021b7
mov dword [rbp + rbx*4 - 0x49], ecx
inc ebx
mov edx, dword [rbp - 0x19]
mov ecx, dword [rbp - 0x15]
cmp edx, ecx
je 0x1400021c7
mov dword [rbp + rbx*4 - 0x49], edx
inc ebx
mov ecx, dword [rbp - 0x15]
mov edx, dword [rbp - 0x11]
cmp ecx, edx
je 0x1400021d7
mov dword [rbp + rbx*4 - 0x49], ecx
inc ebx
mov edx, dword [rbp - 0x11]
mov dword [rbp + rbx*4 - 0x49], edx
lea rcx, [rbp - 0x49]
inc ebx
mov edx, ebx
call fcn.140002a90
mov edi, ebx
test ebx, ebx
je 0x140002228
mov rbx, r14
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rbp + rbx*4 - 0x49]
lea rdx, [0x140003488]
lea rcx, [rbp + 0x17]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
inc rbx
cmp rbx, rdi
jl 0x140002200
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x14000225e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp - 9], 0xffffffffffffffff
mov qword [rbp - 1], r14
call fcn.140001780
test eax, eax
jne 0x1400022a5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400023b4
lea rdx, str.____Failed_To_Initialize_The_Specified_Indirect_Syscalls__n
jmp 0x140002373
mov qword [rbp + 0x6f], r14
mov qword [rbp + 0x77], r14
mov qword [rbp + 0x7f], r14
mov qword [rbp + 0xf], r14
mov qword [rbp + 7], 0x114
mov dword [rbp + 0x67], r14d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002332
lea r8, str.powershell.exe
mov rcx, rax
lea rdx, str._i__Targetting_Remote_Process__s_...__n
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r8, [rbp - 9]
lea rdx, [rbp + 0x67]
lea rcx, str.powershell.exe
call fcn.140001500
test eax, eax
jne 0x1400023c8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400023b4
lea rdx, str.____Could_Not_Find_Target_Process_Id__n
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xffffffff
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002436
mov r8d, dword [rbp + 0x67]
lea rdx, str.___Target_Process_Id_Detected_Of_PID_:__d__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [0x140004280]
mov ecx, dword [0x140004270]
call fcn.140002d00
mov qword [rsp + 0x30], r14
lea r9, [rbp + 7]
mov dword [rsp + 0x28], 0x8000000
lea rcx, [rbp + 0x7f]
xor r8d, r8d
mov dword [rsp + 0x20], 0x40
mov edx, 0xf001f
call fcn.140002d22
mov ebx, eax
test eax, eax
jns 0x1400024b6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002a76
mov r8d, ebx
lea rdx, str.____NtCreateSection_Failed_With_Error:_0x_0.8X__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x140002a3e
mov rdx, qword [0x140004190]
mov ecx, dword [0x140004180]
call fcn.140002d00
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0xf]
mov dword [rsp + 0x48], 4
lea r8, [rbp + 0x6f]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r14
call fcn.140002d22
mov ebx, eax
test eax, eax
js 0x14000275a
cmp qword [rbp + 0x6f], r14
je 0x14000275a
mov rdx, qword [0x140004190]
mov ecx, dword [0x140004180]
call fcn.140002d00
mov rdx, qword [rbp - 9]
lea rax, [rbp + 0xf]
mov rcx, qword [rbp + 0x7f]
lea r8, [rbp + 0x77]
mov dword [rsp + 0x48], 0x40
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.140002d22
mov ebx, eax
test eax, eax
js 0x140002730
cmp qword [rbp + 0x77], r14
je 0x140002730
mov rcx, qword [rbp + 0x6f]
lea rdx, section..data
mov r8d, 0x114
call fcn.140002ca0
mov rdx, qword [rbp + 0x6f]
lea rcx, [0x140004118]
mov r9d, 0x114
mov r8d, 0x19
call fcn.140001af0
test eax, eax
je 0x140002a76
mov rdx, qword [0x1400041a8]
mov ecx, dword [0x140004198]
call fcn.140002d00
mov rdx, qword [rbp + 0x6f]
mov rcx, 0xffffffffffffffff
call fcn.140002d22
mov ebx, eax
test eax, eax
jns 0x14000261a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002a76
mov r9d, ebx
lea rdx, str.____NtUnmapViewOfSection___d__Failed_With_Error:_0x_0.8X__n
mov r8d, 0x2f1
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x140002a3e
mov rdx, qword [0x140004208]
mov ecx, dword [0x1400041f8]
mov qword [rbp + 0x6f], r14
call fcn.140002d00
mov rax, qword [rbp + 0x77]
lea rcx, [rbp - 1]
mov r9, qword [rbp - 9]
xor r8d, r8d
mov qword [rsp + 0x50], r14
mov edx, 0x1fffff
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.140002d22
mov ebx, eax
test eax, eax
jns 0x1400026b0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400027cd
mov r8d, ebx
lea rdx, str.____NtCreateThreadEx_Failed_With_Error:_0x_0.8X__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x140002795
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x1400026c0
mov rax, qword [rbp - 1]
mov qword [rcx], rax
mov rcx, qword [rbp + 0x77]
mov rax, qword [rbp + 0x67]
mov rdx, qword [0x140004220]
mov qword [rax], rcx
mov ecx, dword [0x140004210]
call fcn.140002d00
mov rcx, qword [rbp - 1]
xor r8d, r8d
xor edx, edx
call fcn.140002d22
mov ebx, eax
test eax, eax
jns 0x1400027cd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400027cd
mov r8d, ebx
lea rdx, str.____NtWaitForSingleObject_Failed_With_Error:_0x_0.8X__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x140002795
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400027cd
mov r8d, 0x2e2
jmp 0x140002782
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400027cd
mov r8d, 0x2da
mov r9d, ebx
lea rdx, str.____NtMapViewOfSection___d__Failed_With_Error:_0x_0.8X__n
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x6f], r14
je 0x140002872
mov rdx, qword [0x1400041a8]
mov ecx, dword [0x140004198]
call fcn.140002d00
mov rdx, qword [rbp + 0x6f]
mov rcx, 0xffffffffffffffff
call fcn.140002d22
mov ebx, eax
test eax, eax
jns 0x140002872
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002872
mov r9d, ebx
lea rdx, str.____NtUnmapViewOfSection___d__Failed_With_Error:_0x_0.8X__n
mov r8d, 0x31f
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [0x1400041a8]
mov ecx, dword [0x140004198]
call fcn.140002d00
mov rdx, qword [rbp + 0x77]
mov rcx, qword [rbp - 9]
call fcn.140002d22
mov ebx, eax
test eax, eax
jns 0x14000290a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14000290a
mov r9d, ebx
lea rdx, str.____NtUnmapViewOfSection___d__Failed_With_Error:_0x_0.8X__n
mov r8d, 0x328
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x7f], r14
je 0x1400029a2
mov rdx, qword [0x1400041c0]
mov ecx, dword [0x1400041b0]
call fcn.140002d00
mov rcx, qword [rbp + 0x7f]
call fcn.140002d22
mov ebx, eax
test eax, eax
jns 0x1400029a2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400029a2
mov r8d, ebx
lea rdx, str.____NtClose_Failed_With_Error:_0x_0.8X__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002a0c
lea rdx, str.___DONE__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002a76
lea rdx, str.___Press__Enter__To_Quit_...
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret