Function at 0x18001675c
Capabilities:
Create process on windows
Create thread
Inject dll
Inject thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x730
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x720], rax
mov r12, r9
mov rsi, r8
mov rbx, rdx
xor r13d, r13d
mov ebp, r13d
cmp dword [rcx + 8], r13d
jne 0x1800167b4
call fcn.18001662c
mov ebp, eax
cmp eax, r13d
je 0x1800167b4
mov eax, 0x80004005
jmp 0x180016c65
lea r14, [0x18015f578]
cmp dword [rbx + 4], 6
jne 0x1800167f2
lea rdx, str.RunDll_detected__checking_command_params...
mov rcx, r14
call fcn.1800098e8
mov ecx, dword [rbx]
call fcn.180016c88
cmp eax, r13d
jne 0x1800167f2
lea rdx, str.RunDll_ignored.
mov rcx, r14
call fcn.1800098e8
xor eax, eax
jmp 0x180016c65
mov dword [rsp + 0x50], r13d
lea rdx, [rsp + 0x50]
mov ecx, dword [rbx]
call qword [sym.imp.EasyHook64.dll_RhIsX64Process]
cmp dword [rsp + 0x50], r13d
je 0x1800169cf
cmp dword [rbx + 4], 2
jne 0x18001681f
mov eax, 0x80004001
jmp 0x180016c65
mov edi, 0x68
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.1800d7640
mov dword [rsp + 0x80], edi
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rsp + 0x510]
lea rdx, [rsp + 0x300]
mov rcx, rsi
call fcn.1800d318c
lea rdi, [rsp + 0x300]
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x510]
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x18001688c
mov rax, qword [0x18015f768]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], r12
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
lea r9, str.hlp64.exe
lea r8, [rsp + 0x300]
lea rdx, str._s_s__d_s
lea rcx, [rsp + 0x58]
call fcn.180008f64
mov rdx, qword [rsp + 0x58]
mov edx, dword [rdx - 8]
inc edx
lea rcx, [rsp + 0x58]
call fcn.180003ee8
mov rdx, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
lea rcx, [rsp + 0x58]
call fcn.180003f8c
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rdi - 8], eax
movsxd rcx, eax
mov word [rdi + rcx*2], r13w
cmp ebx, r13d
jne 0x18001697b
lea rcx, [rdi - 0xc]
lea rax, [0x18015f758]
cmp rcx, rax
je 0x180016971
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
cmp eax, r13d
jg 0x180016971
call fcn.1800d1434
mov eax, 0x1ab6
jmp 0x180016c65
or edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rdi - 0xc]
lea rax, [0x18015f758]
cmp rcx, rax
je 0x180016c63
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
cmp eax, r13d
jg 0x180016c63
call fcn.1800d1434
jmp 0x180016c63
lea rcx, [0x18015f720]
call fcn.1800ce414
cmp eax, 6
je 0x180016a38
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov ecx, dword [rbx]
call qword [sym.imp.EasyHook64.dll_RhInjectLibrary]
cmp eax, r13d
je 0x180016c63
mov dword [rsp + 0x28], eax
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
lea r9, str.PROCESSINJ_:_Cannot_open_process__d._NTError_:__d
mov r8d, 0x5e
lea rdx, str..RemoteInjector.cpp
mov rcx, r14
call fcn.18000b1e8
mov eax, 0x80004005
jmp 0x180016c65
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
cmp rax, r13
jne 0x180016a86
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
lea r9, str.PROCESSINJ_:_Cannot_open_process__d._Error_:__d
mov r8d, 0x69
lea rdx, str..RemoteInjector.cpp
mov rcx, r14
call fcn.18000b1e8
mov eax, 0x80004005
jmp 0x180016c65
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
cmp rax, r13
jne 0x180016ad4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.PROCESSINJ_:_Cannot_fine_kernel32.dll._Error_:__d
mov r8d, 0x74
lea rdx, str..RemoteInjector.cpp
mov rcx, r14
call fcn.18000b1e8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x180016c65
lea rcx, [rsp + 0xf0]
sub rcx, rsi
movzx eax, word [rsi]
mov word [rcx + rsi], ax
add rsi, 2
cmp ax, r13w
jne 0x180016adf
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov r8d, 0x410
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
cmp rax, r13
jne 0x180016b63
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
lea r9, str.PROCESSINJ_:_Cannot_virtual_alloc_process__d_with_path__s._Error_:__d
mov r8d, 0x7e
lea rdx, str..RemoteInjector.cpp
mov rcx, r14
call fcn.18000b1e8
mov eax, 0x80004005
jmp 0x180016c65
mov qword [rsp + 0x20], r13
mov r9d, 0x410
lea r8, [rsp + 0xf0]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp eax, r13d
jne 0x180016bd3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
lea r9, str.PROCESSINJ_:_Cannot_write_process_mem_on_process__d_with_path__s._Error_:__d
mov r8d, 0x85
lea rdx, str..RemoteInjector.cpp
mov rcx, r14
call fcn.18000b1e8
mov eax, 0x80004005
jmp 0x180016c65
lea rdx, [0x18010f2b0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp rax, r13
jne 0x180016c51
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
lea r9, str.PROCESSINJ_:_Cannot_CreateRemoteThread_on_process__d_with_path__s._Error_:__d
mov r8d, 0x91
lea rdx, str..RemoteInjector.cpp
mov rcx, r14
call fcn.18000b1e8
mov eax, 0x80004005
jmp 0x180016c65
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rcx, qword [rsp + 0x720]
xor rcx, rsp
call fcn.1800d12b0
add rsp, 0x730
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret