Function at 0x1400012e0
Capabilities:
Create thread
Enumerate process modules
Enumerate processes
Inject dll
Inject thread
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rbp + 0x470], rax
mov rdx, qword [rbp + 0x4e0]
mov r13, rcx
mov rbx, qword [0x140028cb0]
lea rcx, [rbp + 0x24]
mov qword [rsp + 0x70], rdx
xor edi, edi
xor edx, edx
mov r8d, 0x234
mov r15d, edi
call fcn.140003060
xorps xmm0, xmm0
mov dword [rbp - 0x80], edi
xor eax, eax
mov qword [rbp - 0x78], rdi
mov rdx, r13
mov qword [rbp - 0x30], rax
lea rcx, str.1._Hook_Library_Path:__s_n
mov dword [rbp - 0x7c], edi
movups xmmword [rbp - 0x70], xmm0
mov r12d, edi
mov dword [rbp - 0x20], edi
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
call fcn.140001010
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
jne 0x1400013ac
test rbx, rbx
je 0x1400013a2
lea rdx, str.2._ERROR:_Cannot_load_injection_library._n
mov rcx, rbx
call fcn.140001070
mov eax, 2
jmp 0x140001d9b
lea rdx, str.main
mov qword [rsp + 0x5b8], rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1400013ea
test rbx, rbx
je 0x1400013e0
lea rdx, str.2._ERROR:_Injection_library_lacks_entry_point._n
mov rcx, rbx
call fcn.140001070
mov eax, 0x21
jmp 0x140001d93
sub rsi, rdi
mov rcx, rdi
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdx, rsi
lea rcx, str.2._Hook_Library_Entry_Point:_0x_x_n
call fcn.140001010
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x14000143d
test rbx, rbx
je 0x140001433
lea rdx, str.3._ERROR:_Cannot_find_address_of_Kernel32._n
mov rcx, rbx
call fcn.140001070
mov eax, 3
jmp 0x140001d93
lea rdx, [0x140023730]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
mov rsi, rax
test rax, rax
jne 0x140001478
test rbx, rbx
je 0x14000146e
lea rdx, str.3._ERROR:_Cannot_find_address_of_LoadLibraryW._n
mov rcx, rbx
call fcn.140001070
mov eax, 0x31
jmp 0x140001d93
mov rdx, rax
lea rcx, str.3._LoadLibraryW_address:__d_n
call fcn.140001010
lea rdx, [0x1400237b0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x1400014bf
test rbx, rbx
je 0x1400014b5
lea rdx, str.3._ERROR:_Cannot_find_address_of_FreeLibrary._n
mov rcx, rbx
call fcn.140001070
mov eax, 0x32
jmp 0x140001d93
mov rdx, rax
mov qword [rsp + 0x5c0], r14
lea rcx, str.3._FreeLibrary_address:__d_n
call fcn.140001010
xor edx, edx
mov dword [rbp + 0x20], 0x238
lea r14, str.dwm.exe
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp + 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1400015b0
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1400015b0
nop
xor eax, eax
lea rdx, [rbp + 0x4c]
nop word [rax + rax]
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [r14 + rax*2 - 2]
jne 0x140001569
cmp rax, 8
jne 0x140001530
mov r12d, dword [rbp + 0x28]
lea rdx, [rbp - 0x20]
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x140001a7e
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp dword [rbp - 0x20], eax
je 0x14000157d
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140001520
jmp 0x1400015b0
mov r8d, r12d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x140001a60
test rbx, rbx
je 0x1400015b0
mov r8d, r12d
lea rdx, str.4._Found_application__PID:__d_n
mov rcx, rbx
call fcn.140001070
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x140001d72
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8d, 0x208
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x140001d57
xor r14d, r14d
mov r9d, 0x208
mov r8, r13
mov qword [rsp + 0x20], r14
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001d27
test rbx, rbx
je 0x140001639
lea rdx, str.5._Wrote_library_path_in_applications_memory._n
mov rcx, rbx
call fcn.140001070
mov qword [rsp + 0x30], r14
mov r9, rsi
mov dword [rsp + 0x28], r14d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
test rax, rax
je 0x140001d0c
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 0x7c]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [rbp - 0x7c]
test ecx, ecx
je 0x140001cf1
test eax, eax
je 0x140001cf1
mov r14d, ecx
test rbx, rbx
je 0x1400016d0
lea rdx, str.6._Successfully_injected_library_into_application._n
mov rcx, rbx
call fcn.140001070
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
lea rdx, str.7._Freed_path_from_applications_memory._n
mov rcx, rbx
call fcn.140001070
jmp 0x1400016e5
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, 1
mov ecx, 0x320
call fcn.140005f8c
mov rsi, rax
test rax, rax
je 0x140001cb6
lea r9, [rbp - 0x80]
mov dword [rsp + 0x20], 3
mov r8d, 0x320
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModulesEx]
test eax, eax
je 0x140001c7b
mov ecx, dword [rbp - 0x80]
cmp ecx, 0x320
jbe 0x14000176b
mov edx, ecx
mov rcx, rsi
call fcn.140006390
mov rsi, rax
test rax, rax
je 0x140001adf
mov r8d, dword [rbp - 0x80]
lea r9, [rbp - 0x80]
mov rdx, rax
mov dword [rsp + 0x20], 3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModulesEx]
test eax, eax
je 0x140001a9c
mov rcx, r13
call qword [sym.imp.USER32.dll_CharLowerW]
mov ecx, dword [rbp - 0x80]
test ecx, 0xfffffff8
je 0x140001c42
xor edi, edi
nop word [rax + rax]
mov eax, ecx
shr rax, 3
cmp rdi, rax
je 0x140001c42
mov rdx, qword [rsi + rdi*8]
lea r8, [rbp + 0x260]
mov r9d, 0x104
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x1400017f8
lea rcx, [rbp + 0x260]
call qword [sym.imp.USER32.dll_CharLowerW]
lea rax, [rbp + 0x260]
mov r8, r13
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400017f4
add rax, 2
test ecx, ecx
jne 0x1400017e0
test edx, edx
je 0x14000180b
mov ecx, dword [rbp - 0x80]
inc rdi
mov eax, ecx
shr rax, 3
cmp rdi, rax
jbe 0x140001790
jmp 0x14000180e
mov ecx, dword [rbp - 0x80]
cmp rdi, 0xffffffffffffffff
je 0x140001c42
mov r8d, ecx
mov rdx, rdi
shr r8, 3
lea rcx, str.8._Found_library_in_applications_memory___d__d_._n
call fcn.140001010
mov r14, qword [rsi + rdi*8]
mov rcx, rsi
call fcn.14000a8b0
lea rax, [0x1400010c0]
mov dword [rbp - 0x70], 8
xor ecx, ecx
mov qword [rbp - 0x68], rax
call qword [sym.imp.GDI32.dll_GetStockObject]
mov rdi, qword [rsp + 0x70]
lea rsi, [0x140023db8]
mov edx, 0x7f00
mov qword [rbp - 0x40], rax
xor ecx, ecx
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x30], rsi
call qword [sym.imp.USER32.dll_LoadCursorW]
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x48], rax
call qword [sym.imp.USER32.dll_RegisterClassW]
mov qword [rsp + 0x58], 0
lea r8, [0x140023b88]
mov qword [rsp + 0x50], rdi
mov r9d, 0xcf0000
xor edi, edi
mov rdx, rsi
mov qword [rsp + 0x48], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
test rax, rax
je 0x140001c08
test rbx, rbx
je 0x1400018fc
mov r8, rax
lea rdx, str.10._Successfully_created_message_window___d_._n
mov rcx, rbx
call fcn.140001070
mov r9, qword [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x30], rdi
add r9, r14
mov dword [rsp + 0x28], edi
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
je 0x140001bcd
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 0x7c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x140001b92
mov eax, dword [rbp - 0x7c]
test eax, eax
je 0x140001965
mov ecx, eax
call fcn.140001dd0
test eax, eax
jne 0x140001d8b
test rbx, rbx
je 0x140001979
lea rdx, str.9._Successfully_hooked_application._n
mov rcx, rbx
call fcn.140001070
mov dword [rsp + 0x28], 8
lea r8, [0x140001140]
mov r9, rsi
mov dword [rsp + 0x20], 0xffffffff
mov rdx, r15
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
cmp qword [rbp - 0x78], 0
je 0x140001b61
test rbx, rbx
je 0x1400019ce
lea rdx, str.11._Registered_for_watching_application._n
mov rcx, rbx
call fcn.140001070
lea rdx, str.Listening_for_messages..._n
mov rcx, rbx
call fcn.140001070
xor r9d, r9d
lea rcx, [rbp - 0x18]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140001a17
cmp eax, 0xffffffff
je 0x140001b16
lea rcx, [rbp - 0x18]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x18]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp - 0x18]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x1400019e4
cmp qword [rbp - 8], 0x222
jne 0x140001b33
mov rdx, qword [rsp + 0x70]
lea rcx, [0x140023db8]
call qword [sym.imp.USER32.dll_UnregisterClassW]
test rbx, rbx
je 0x140001a4b
lea rdx, str.Application_was_restarted__rehooking..._n
mov rcx, rbx
call fcn.140001070
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, qword [rsp + 0x78]
jmp 0x1400014d6
test rbx, rbx
je 0x140001a92
lea rdx, str.4._ERROR:_Cannot_get_handle_to_application._n
mov rcx, rbx
call fcn.140001070
mov eax, 0x41
jmp 0x140001d8b
test rbx, rbx
je 0x140001a92
lea rdx, str.4._ERROR:_Cannot_get_session_ID_from_process_ID._n
mov rcx, rbx
call fcn.140001070
mov eax, 0x41
jmp 0x140001d8b
test rbx, rbx
je 0x140001ab0
lea rdx, str.8._ERROR:_Unable_to_enum_modules_in_application._n
mov rcx, rbx
call fcn.140001070
mov r8, qword [rsp + 0x60]
mov r9, rbx
mov rdx, r14
mov rcx, r15
call fcn.140001200
mov ebx, eax
test eax, eax
je 0x140001cac
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, ebx
jmp 0x140001d8b
test rbx, rbx
je 0x140001af3
lea rdx, str.8._ERROR:_Cannot_reallocate_module_array._n
mov rcx, rbx
call fcn.140001070
mov r8, qword [rsp + 0x60]
mov r9, rbx
mov rdx, r14
mov rcx, r15
call fcn.140001200
mov ebx, eax
test eax, eax
jne 0x140001acd
mov eax, 0x83
jmp 0x140001d8b
mov r8, qword [rsp + 0x68]
mov r9, rbx
mov rdx, r14
mov rcx, r15
call fcn.140001160
mov eax, 0x13
jmp 0x140001d8b
test rbx, rbx
je 0x140001b47
lea rdx, str.Shutting_down_application..._n
mov rcx, rbx
call fcn.140001070
mov r8, qword [rsp + 0x68]
mov r9, rbx
mov rdx, r14
mov rcx, r15
call fcn.140001160
xor eax, eax
jmp 0x140001d8b
test rbx, rbx
je 0x140001b75
lea rdx, str.11._Unable_to_register_for_watching_application._n
mov rcx, rbx
call fcn.140001070
mov r8, qword [rsp + 0x68]
mov r9, rbx
mov rdx, r14
mov rcx, r15
call fcn.140001160
mov eax, 0x11
jmp 0x140001d8b
test rbx, rbx
je 0x140001ba6
lea rdx, str.9._ERROR:_Cannot_determine_status_of_injected_DLL._n
mov rcx, rbx
call fcn.140001070
mov r8, qword [rsp + 0x60]
mov r9, rbx
mov rdx, r14
mov rcx, r15
call fcn.140001200
mov ebx, eax
test eax, eax
jne 0x140001acd
mov eax, 0x93
jmp 0x140001d8b
test rbx, rbx
je 0x140001be1
lea rdx, str.9._ERROR:_Cannot_execute_injection_entry_point._n
mov rcx, rbx
call fcn.140001070
mov r8, qword [rsp + 0x60]
mov r9, rbx
mov rdx, r14
mov rcx, r15
call fcn.140001200
mov ebx, eax
test eax, eax
jne 0x140001acd
mov eax, 0x91
jmp 0x140001d8b
test rbx, rbx
je 0x140001c25
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.10._Failed_to_create_message_window___d_._n
mov rcx, rbx
mov r8d, eax
call fcn.140001070
mov r8, qword [rsp + 0x68]
mov r9, rbx
mov rdx, r14
mov rcx, r15
call fcn.140001160
mov eax, 0x10
jmp 0x140001d8b
test rbx, rbx
je 0x140001c56
lea rdx, str.8._ERROR:_Cannot_find_library_in_applications_memory._n
mov rcx, rbx
call fcn.140001070
mov r8, qword [rsp + 0x60]
mov r9, rbx
mov rdx, r14
mov rcx, r15
call fcn.140001200
mov ebx, eax
test eax, eax
jne 0x140001acd
lea eax, [rbx + 8]
jmp 0x140001d8b
test rbx, rbx
je 0x140001c8f
lea rdx, str.8._ERROR:_Unable_to_enum_modules_in_application._n
mov rcx, rbx
call fcn.140001070
mov r8, qword [rsp + 0x60]
mov r9, rbx
mov rdx, r14
mov rcx, r15
call fcn.140001200
mov ebx, eax
test eax, eax
jne 0x140001acd
mov eax, 0x82
jmp 0x140001d8b
test rbx, rbx
je 0x140001cca
lea rdx, str.8._ERROR:_Cannot_allocate_module_array._n
mov rcx, rbx
call fcn.140001070
mov r8, qword [rsp + 0x60]
mov r9, rbx
mov rdx, r14
mov rcx, r15
call fcn.140001200
mov ebx, eax
test eax, eax
jne 0x140001acd
mov eax, 0x81
jmp 0x140001d8b
test rbx, rbx
je 0x140001d05
lea rdx, str.6._ERROR:_Failed_to_run_library_entry_point_in_application._n
mov rcx, rbx
call fcn.140001070
mov eax, 0x61
jmp 0x140001d8b
test rbx, rbx
je 0x140001d20
lea rdx, str.6._ERROR:_Failed_to_inject_library_into_application._n
mov rcx, rbx
call fcn.140001070
mov eax, 6
jmp 0x140001d8b
test rbx, rbx
je 0x140001d3b
lea rdx, str.5._ERROR:_Cannot_write_memory_in_application._n
mov rcx, rbx
call fcn.140001070
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 0x51
jmp 0x140001d8b
test rbx, rbx
je 0x140001d6b
lea rdx, str.5._ERROR:_Cannot_alloc_memory_in_application._n
mov rcx, rbx
call fcn.140001070
mov eax, 5
jmp 0x140001d8b
test rbx, rbx
je 0x140001d86
lea rdx, str.4._ERROR:_Application_is_not_running._n
mov rcx, rbx
call fcn.140001070
mov eax, 4
mov r14, qword [rsp + 0x5c0]
mov rsi, qword [rsp + 0x5b8]
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.140001f70
mov rbx, qword [rsp + 0x5c8]
add rsp, 0x580
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret