Function at 0x140064d60
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rbx, r8
mov r8d, edx
xor edx, edx
mov ecx, 0x42a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140064ef9
mov rax, qword [rbx + 0x10]
lea r14, [rax*2 + 2]
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, r14
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdi
test rax, rax
je 0x140064f1a
cmp qword [rbx + 0x18], 8
jb 0x140064de4
mov rbx, qword [rbx]
xor r15d, r15d
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140064f3b
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140064f5c
lea rdx, str.LoadLibraryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140064f7d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rsi
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140064f9e
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x140064fbf
cmp dword [rbp + 0x30], r15d
je 0x140064ed8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x48], r15
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov qword [rbp - 0x38], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x40], r15
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.Call_to_LoadLibraryW_in_remote_process_failed.
lea rcx, [rbp - 0x20]
call fcn.140001630
lea rdx, [0x140083d30]
lea rcx, [rbp - 0x20]
call fcn.14003b148
nop
lea rdx, str.Could_not_get_handle_to_process.
lea rcx, [rbp - 0x38]
call fcn.140001630
lea rdx, [0x140083d30]
lea rcx, [rbp - 0x38]
call fcn.14003b148
nop
lea rdx, str.Could_not_allocate_memory_in_remote_process.
lea rcx, [rbp - 0x20]
call fcn.140001630
lea rdx, [0x140083d30]
lea rcx, [rbp - 0x20]
call fcn.14003b148
int3
lea rdx, str.Could_not_write_to_memory_in_remote_process.
lea rcx, [rbp - 0x20]
call fcn.140001630
lea rdx, [0x140083d30]
lea rcx, [rbp - 0x20]
call fcn.14003b148
int3
lea rdx, str.Could_not_get_handle_to_Kernel32.
lea rcx, [rbp - 0x20]
call fcn.140001630
lea rdx, [0x140083d30]
lea rcx, [rbp - 0x20]
call fcn.14003b148
int3
lea rdx, str.Could_not_get_pointer_to_LoadLibraryW.
lea rcx, [rbp - 0x20]
call fcn.140001630
lea rdx, [0x140083d30]
lea rcx, [rbp - 0x20]
call fcn.14003b148
nop
lea rdx, str.Could_not_create_thread_in_remote_process.
lea rcx, [rbp - 0x20]
call fcn.140001630
lea rdx, [0x140083d30]
lea rcx, [rbp - 0x20]
call fcn.14003b148
int3
lea rdx, str.Could_not_get_thread_exit_code.
lea rcx, [rbp - 0x20]
call fcn.140001630
lea rdx, [0x140083d30]
lea rcx, [rbp - 0x20]
call fcn.14003b148
int3