Function at 0x140002c20
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x14000b008]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov rsi, rdx
xor r13d, r13d
mov dword [rsp + 0x60], r13d
cmp ecx, 3
je 0x140002c80
lea rcx, str._nUsage:__YALLINJ.exe_processToInjectTo_libraryName__n
call fcn.140001010
lea rcx, str.Exiting..._n
call fcn.140001010
jmp 0x140002f61
mov rbx, qword [rdx + 8]
mov r15, 0xffffffffffffffff
mov rdi, r15
nop
inc rdi
cmp byte [rbx + rdi], r13b
jne 0x140002c90
call fcn.140005878
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rdi
lea r8, [rsp + 0x90]
mov edx, eax
lea rcx, [rsp + 0xe0]
call fcn.140001930
nop
mov rbx, qword [rsi + 0x10]
mov rdi, r15
nop dword [rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140002cd0
call fcn.140005878
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rdi
lea r8, [rsp + 0x90]
mov edx, eax
lea rcx, [rsp + 0xa0]
call fcn.140001930
mov ebx, 0xf0
lea rcx, [rsp + 0xe0]
call fcn.140001ea0
test al, al
je 0x140002dc9
call fcn.140005878
lea r14, str..exe
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], 4
lea r8, [rsp + 0x90]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140001930
nop
mov dword [rsp + 0x60], 0x3f1
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xe0]
call fcn.140001d90
mov ebx, 0x3f3
lea rcx, [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
cmp rdi, 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x90], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x98], rcx
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x90], xmm0
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140001b80
test eax, eax
je 0x140002dd5
mov sil, 1
jmp 0x140002dd8
lea r14, str..exe
mov rdi, qword [rsp + 0x58]
xor sil, sil
test bl, 2
je 0x140002e4a
and ebx, 0xfffffffd
mov rdx, qword [rsp + 0xd8]
cmp rdx, 8
jb 0x140002e30
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e26
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov rdi, qword [rsp + 0x58]
movdqa xmm0, xmmword [0x140008900]
movdqu xmmword [rsp + 0xd0], xmm0
mov word [rsp + 0xc0], r13w
test bl, 1
je 0x140002e92
and ebx, 0xfffffffe
cmp rdi, 8
jb 0x140002e92
lea rdx, [rdi*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
test sil, sil
je 0x140002f95
lea rcx, str._nUsage:__YALLINJ.exe_processToInjectTo_libraryName__n
call fcn.140001010
lea rcx, str.Exiting..._n
call fcn.140001010
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 8
jb 0x140002efc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140002ef7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f66
call fcn.140005fcc
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xb8], 7
mov word [rsp + 0xa0], r13w
mov rdx, qword [rsp + 0xf8]
cmp rdx, 8
jb 0x140002f61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fda
call fcn.140005fcc
xor eax, eax
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140005f70
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rcx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rcx, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xf0]
lea rdx, [rcx + rax*2]
mov rdi, rdx
call fcn.140001a90
cmp rax, rdx
je 0x14000300c
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x140002fdf
cmp cx, 0x2f
jne 0x140002fe8
add rax, 2
cmp rax, rdx
jne 0x140002fd0
cmp rax, rdx
je 0x14000300c
nop dword [rax]
lea r8, [rdi - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x14000300c
cmp cx, 0x2f
je 0x14000300c
mov rdi, r8
cmp rax, r8
jne 0x140002ff0
mov r8d, 0x3a
mov rcx, rdi
call fcn.140005e90
cmp rdi, rax
je 0x140003057
lea rcx, [rax - 2]
cmp rdi, rcx
je 0x140003057
cmp word [rcx], 0x2e
jne 0x14000303f
lea rdx, [rcx - 2]
cmp rdi, rdx
jne 0x14000305a
cmp word [rdx], 0x2e
jne 0x14000305a
jmp 0x140003057
sub rcx, 2
cmp rdi, rcx
je 0x140003057
cmp word [rcx], 0x2e
je 0x14000305a
sub rcx, 2
cmp rdi, rcx
jne 0x140003048
mov rcx, rax
sub rax, rcx
cmp rax, 2
jae 0x140003177
call fcn.140005878
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], 4
lea r8, [rsp + 0x90]
mov edx, eax
lea rcx, [rsp + 0xc0]
call fcn.140001930
or ebx, 0xc00
mov rsi, qword [rsp + 0xd0]
lea r9, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 8
cmovae r9, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
sub rax, r14
cmp rsi, rax
ja 0x140003116
lea rax, [r14 + rsi]
mov qword [rsp + 0xf0], rax
lea rdi, [rsp + 0xe0]
cmp rcx, 8
cmovae rdi, qword [rsp + 0xe0]
lea rcx, [rdi + r14*2]
lea r8, [rsi + rsi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + r14]
mov word [rdi + rax*2], r13w
jmp 0x14000312c
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rsp + 0xe0]
call fcn.140004990
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 8
jb 0x140003177
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003172
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003172
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xb0]
lea rdx, [rcx + rax*2]
mov rdi, rdx
call fcn.140001a90
cmp rax, rdx
je 0x1400031ec
nop word [rax + rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400031bf
cmp cx, 0x2f
jne 0x1400031c8
add rax, 2
cmp rax, rdx
jne 0x1400031b0
cmp rax, rdx
je 0x1400031ec
nop dword [rax]
lea r8, [rdi - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x1400031ec
cmp cx, 0x2f
je 0x1400031ec
mov rdi, r8
cmp rax, r8
jne 0x1400031d0
mov r8d, 0x3a
mov rcx, rdi
call fcn.140005e90
cmp rdi, rax
je 0x140003237
lea rcx, [rax - 2]
cmp rdi, rcx
je 0x140003237
cmp word [rcx], 0x2e
jne 0x14000321f
lea rdx, [rcx - 2]
cmp rdi, rdx
jne 0x14000323a
cmp word [rdx], 0x2e
jne 0x14000323a
jmp 0x140003237
sub rcx, 2
cmp rdi, rcx
je 0x140003237
cmp word [rcx], 0x2e
je 0x14000323a
sub rcx, 2
cmp rdi, rcx
jne 0x140003228
mov rcx, rax
sub rax, rcx
cmp rax, 2
jb 0x1400033d6
call fcn.140005878
lea r14, str..dll
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], 4
lea r8, [rsp + 0x90]
mov edx, eax
lea rcx, [rsp + 0xc0]
call fcn.140001930
or ebx, 0x3000
or ebx, 4
mov dword [rsp + 0x60], ebx
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xb0]
lea rdx, [rcx + rax*2]
mov rdi, rdx
call fcn.140001a90
cmp rax, rdx
je 0x1400032fc
nop
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400032cf
cmp cx, 0x2f
jne 0x1400032d8
add rax, 2
cmp rax, rdx
jne 0x1400032c0
cmp rax, rdx
je 0x1400032fc
nop dword [rax]
lea r8, [rdi - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x1400032fc
cmp cx, 0x2f
je 0x1400032fc
mov rdi, r8
cmp rax, r8
jne 0x1400032e0
mov r8d, 0x3a
mov rcx, rdi
call fcn.140005e90
cmp rdi, rax
je 0x140003347
lea rdx, [rax - 2]
cmp rdi, rdx
je 0x140003347
cmp word [rdx], 0x2e
jne 0x14000332f
lea rcx, [rdx - 2]
cmp rdi, rcx
jne 0x14000334a
cmp word [rcx], 0x2e
jne 0x14000334a
jmp 0x140003347
sub rdx, 2
cmp rdi, rdx
je 0x140003347
cmp word [rdx], 0x2e
je 0x14000334a
sub rdx, 2
cmp rdi, rdx
jne 0x140003338
mov rdx, rax
sub rax, rdx
sar rax, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov r8, rax
lea rcx, [rsp + 0x40]
call fcn.140004b60
or ebx, 0x1c008
lea rax, [rsp + 0xc0]
mov rdi, qword [rsp + 0xd8]
cmp rdi, 8
cmovae rax, qword [rsp + 0xc0]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x90], xmm0
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.140001b80
test eax, eax
je 0x1400033e5
mov sil, 1
jmp 0x1400033e8
lea r14, str..dll
mov rdi, qword [rsp + 0xd8]
xor sil, sil
test bl, 8
je 0x140003451
and ebx, 0xfffffff7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000343d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003430
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003430
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov rdi, qword [rsp + 0xd8]
movdqa xmm0, xmmword [0x140008900]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r13w
test bl, 4
je 0x14000349c
and ebx, 0xfffffffb
cmp rdi, 8
jb 0x14000349c
lea rdx, [rdi*2 + 2]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003497
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003497
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
test sil, sil
jne 0x140002e9b
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xb0]
lea rdx, [rcx + rax*2]
mov rdi, rdx
call fcn.140001a90
cmp rax, rdx
je 0x14000351c
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400034ef
cmp cx, 0x2f
jne 0x1400034f8
add rax, 2
cmp rax, rdx
jne 0x1400034e0
cmp rax, rdx
je 0x14000351c
nop dword [rax]
lea r9, [rdi - 2]
movzx ecx, word [r9]
cmp cx, 0x5c
je 0x14000351c
cmp cx, 0x2f
je 0x14000351c
mov rdi, r9
cmp rax, r9
jne 0x140003500
mov r8d, 0x3a
mov rcx, rdi
call fcn.140005e90
cmp rdi, rax
je 0x140003567
lea rcx, [rax - 2]
cmp rdi, rcx
je 0x140003567
cmp word [rcx], 0x2e
jne 0x14000354f
lea rdx, [rcx - 2]
cmp rdi, rdx
jne 0x14000356a
cmp word [rdx], 0x2e
jne 0x14000356a
jmp 0x140003567
sub rcx, 2
cmp rdi, rcx
je 0x140003567
cmp word [rcx], 0x2e
je 0x14000356a
sub rcx, 2
cmp rdi, rcx
jne 0x140003558
mov rcx, rax
sub rax, rcx
cmp rax, 2
jae 0x140003687
call fcn.140005878
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], 4
lea r8, [rsp + 0x90]
mov edx, eax
lea rcx, [rsp + 0xc0]
call fcn.140001930
or ebx, 0x600000
mov rsi, qword [rsp + 0xd0]
lea r9, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 8
cmovae r9, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
sub rax, r14
cmp rsi, rax
ja 0x140003626
lea rax, [r14 + rsi]
mov qword [rsp + 0xb0], rax
lea rdi, [rsp + 0xa0]
cmp rcx, 8
cmovae rdi, qword [rsp + 0xa0]
lea rcx, [rdi + r14*2]
lea r8, [rsi + rsi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + r14]
mov word [rdi + rax*2], r13w
jmp 0x14000363c
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rsp + 0xa0]
call fcn.140004990
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 8
jb 0x140003687
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003682
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003682
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
lea rdx, str._exeArg_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400046b0
mov rdi, rax
lea rcx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x90], rcx
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x98], rcx
call fcn.140005878
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x90], xmm0
lea r8, [rsp + 0x90]
mov edx, eax
lea rcx, [rsp + 0xc0]
call fcn.1400043f0
or ebx, 0x60000
lea rax, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 0x10
cmovae rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
mov word [rsp + 0x50], 0x5c22
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140005540
mov rdi, rax
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x14000378b
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003786
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003786
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
movdqa xmm0, xmmword [0x140008910]
movdqu xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xc0], 0
lea rdx, [0x140004950]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._dllArg_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400046b0
mov rdi, rax
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x90], rcx
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x98], rcx
call fcn.140005878
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x90], xmm0
lea r8, [rsp + 0x90]
mov edx, eax
lea rcx, [rsp + 0xc0]
call fcn.1400043f0
or ebx, 0x180000
lea rax, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 0x10
cmovae rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
mov word [rsp + 0x50], 0x5c22
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140005540
mov rdi, rax
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x1400038b8
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400038b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
movdqa xmm0, xmmword [0x140008910]
movdqu xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xc0], 0
lea rdx, [0x140004950]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rsp + 0xc0]
call fcn.140005b08
mov edx, eax
test eax, eax
jne 0x14000396e
mov eax, dword [rsp + 0xd0]
test al, 1
mov ecx, 0x1ff
mov edi, 0x16d
cmovne ecx, edi
mov dword [rsp + 0x94], ecx
bt eax, 0xa
jae 0x140003960
mov ecx, dword [rsp + 0xd4]
cmp ecx, 0xa000000c
jne 0x140003951
lea eax, [rdx + 4]
jmp 0x140003995
cmp ecx, 0xa0000003
jne 0x140003960
mov eax, 0xa
jmp 0x140003995
movzx eax, al
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x140003995
mov dword [rsp + 0x94], 0xffff
sub eax, 2
je 0x140003990
sub eax, 1
je 0x140003990
sub eax, 0x32
je 0x140003990
cmp eax, 0x46
mov eax, r13d
jne 0x140003995
mov eax, 1
mov dword [rsp + 0x90], edx
lea rcx, [0x14000b038]
mov qword [rsp + 0x98], rcx
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x90], xmm0
test eax, eax
je 0x140003ee3
cmp eax, 1
je 0x140003eeb
lea rdx, str._dllArg__Valid
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400046b0
lea rdx, [0x140004950]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x70]
call fcn.140004010
lea rcx, [rsp + 0x70]
call fcn.1400027e0
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
bts ebx, 0x17
mov dword [rsp + 0x60], ebx
cmp qword [rsp + 0xb0], 0
je 0x140003b31
mov edx, 0x104
mov r9d, edx
lea rcx, [rsp + 0x40]
call fcn.140004ef0
nop dword [rax]
nop dword [rax + rax]
mov r14d, dword [rsp + 0x50]
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
mov edx, r14d
call fcn.140005ad8
mov rbx, rax
mov rsi, rax
shr rsi, 0x20
mov ecx, eax
mov r8, qword [rsp + 0x50]
cmp rcx, r8
ja 0x140003acb
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rcx
mov word [rax + rcx*2], r13w
jmp 0x140003b20
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rsp + 0x58]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140003b13
mov qword [rsp + 0x50], rcx
lea r9, [rsp + 0x40]
cmp rdi, 8
cmovae r9, qword [rsp + 0x40]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140003b08
movzx eax, r13w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r13w
jmp 0x140003b20
mov r9, rdx
lea rcx, [rsp + 0x40]
call fcn.140004ef0
cmp ebx, r14d
jae 0x140003a60
test esi, esi
jne 0x140003fe1
mov rdx, qword [rsp + 0xb8]
cmp rdx, 8
jb 0x140003b7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rsp + 0xb0], xmm1
lea rdx, str.dbg:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400046b0
mov rdi, rax
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x90], rcx
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x98], rcx
call fcn.140005878
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x90], xmm0
lea r8, [rsp + 0x90]
mov edx, eax
lea rcx, [rsp + 0xc0]
call fcn.1400043f0
nop
lea rax, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 0x10
cmovae rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
mov word [rsp + 0x50], 0x5c22
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140005540
mov rdi, rax
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x140003c95
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
movdqa xmm0, xmmword [0x140008910]
movdqu xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xc0], 0
lea rdx, [0x140004950]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rax, qword [rsp + 0xa0]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x98], rax
call fcn.140005878
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x90], xmm0
lea r8, [rsp + 0x90]
mov edx, eax
lea rcx, [rsp + 0x100]
call fcn.1400043f0
nop
lea rdi, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rdi, qword [rsp + 0x100]
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400046b0
lea rdx, [0x140004950]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Press_enter_to_attempt_injection
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400046b0
lea rdx, [0x140004950]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
nop
mov r8, r15
nop dword [rax + rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x140003d90
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov r9, r15
nop dword [rax]
inc r9
cmp byte [rdi + r9], 0
jne 0x140003dc0
inc r9
mov qword [rsp + 0x20], r13
mov r8, rdi
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax]
lea r15, [r15 + 1]
cmp byte [rdi + r15], 0
jne 0x140003e30
lea r8, [r15 + 1]
mov r9d, 0x8000
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
lea rdx, str.Succesfully_injected__nSo_long_._._.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400046b0
lea rdx, [0x140004950]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x140003ec5
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ec0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ec0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
movdqa xmm0, xmmword [0x140008910]
movdqu xmmword [rsp + 0x110], xmm0
mov byte [rsp + 0x100], 0
jmp 0x140002eb4
test edx, edx
jne 0x140003ff1
lea rdx, str._n_dllArg__Invalid
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400046b0
lea rdx, [0x140004950]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str._nUsage:__YALLINJ.exe_processToInjectTo_libraryName__n
call fcn.140001010
lea rcx, str.Exiting..._n
call fcn.140001010
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 8
jb 0x140003f72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xb8], 7
mov word [rsp + 0xa0], r13w
mov rdx, qword [rsp + 0xf8]
cmp rdx, 8
jb 0x140002f61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r8, [rsp + 0xa0]
mov edx, esi
call fcn.140002710
nop
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x90]
call fcn.140002780
int3