Function at 0x1400014d0
Capabilities:
Create process on windows
Create thread
Inject thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rbp + 0x400], rax
xor ebx, ebx
mov dword [rbp - 0x70], ebx
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov esi, 4
mov qword [rbp + 0x100], rsi
mov r13d, 0xf
mov qword [rbp + 0x108], r13
mov dword [rbp + 0xf0], 0x4c4c554e
mov byte [rbp + 0xf4], bl
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x2f0]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.appid.txt
lea rcx, [rbp + 0x2f0]
call fcn.140003100
nop
cmp qword [rbp + 0x380], rbx
je 0x14000159f
mov qword [rbp + 0x100], rbx
mov byte [rbp + 0xf0], bl
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x2f0]
call fcn.140003a10
mov rsi, qword [rbp + 0x100]
mov r13, qword [rbp + 0x108]
lea rcx, [rbp + 0x300]
call fcn.140003510
test rax, rax
jne 0x1400015d2
mov rax, qword [rbp + 0x2f0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x2f0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x280], xmm0
movups xmmword [rbp + 0x290], xmm0
movups xmmword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x2b0], xmm0
movups xmmword [rbp + 0x2c0], xmm0
movups xmmword [rbp + 0x2d0], xmm0
mov qword [rbp + 0x2e0], rax
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
movups xmmword [rsp + 0x50], xmm0
lea ecx, [rax + 0x30]
call fcn.1400045b0
mov rdx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x27
mov qword [rsp + 0x68], 0x2f
movups xmm0, xmmword [str.Injector_for_Phasmophobia_by_FreeTP.org]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140006640]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x140006650]
mov dword [rax + 0x20], ecx
movzx eax, word [0x140006654]
mov word [rdx + 0x24], ax
movzx eax, byte [0x140006656]
mov byte [rdx + 0x26], al
mov byte [rdx + 0x27], 0
lea rcx, [rsp + 0x50]
call fcn.140001290
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400016b6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400022a5
call fcn.1400045ec
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov ecx, 0x20
call fcn.1400045b0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x18
mov qword [rsp + 0x68], 0x1f
movups xmm0, xmmword [str.Start___Phasmophobia.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140006668]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], 0
lea rcx, [rsp + 0x50]
call fcn.140001290
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001742
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000173d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400022a5
call fcn.1400045ec
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0x16
jb 0x140002356
lea r15, [rbp + 0xf0]
mov r12, qword [rbp + 0xf0]
cmp r13, 0x10
cmovae r15, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea r14, [rsi + 0x16]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
movabs rax, 0x8000000000000000
lea edx, [rbx + 7]
cmp r14, rbx
jbe 0x14000180e
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400017d5
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.1400045b0
test rax, rax
je 0x1400022a5
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001809
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400017f8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000234a
jmp 0x1400017b6
test rcx, rcx
je 0x140001807
call fcn.1400045b0
mov rdi, rax
jmp 0x140001809
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [str.Current_server_APPID:]
movups xmmword [rdi], xmm0
mov eax, dword [0x140006688]
mov dword [rdi + 0x10], eax
movzx eax, word [0x14000668c]
mov word [rdi + 0x14], ax
lea rcx, [rdi + 0x16]
mov r8, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rcx, [rsp + 0x50]
call fcn.140001290
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001892
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000188d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400022a5
call fcn.1400045ec
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov ecx, 0x30
call fcn.1400045b0
mov rdx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x2b
mov qword [rsp + 0x68], 0x2f
movups xmm0, xmmword [str.Enter_server_APPID_or_press_Enter_to_skip:]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400066a0]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400066b0]
movsd qword [rax + 0x20], xmm0
movzx ecx, word [0x1400066b8]
mov word [rax + 0x28], cx
movzx eax, byte [0x1400066ba]
mov byte [rdx + 0x2a], al
mov byte [rdx + 0x2b], 0
lea rcx, [rsp + 0x50]
call fcn.140001290
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001941
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000193c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400022a5
call fcn.1400045ec
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xor r14d, r14d
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 0xf
mov byte [rbp + 0xd0], r14b
movups xmmword [rbp + 0x260], xmm0
movdqa xmm1, xmmword [0x1400069c0]
movdqu xmmword [rbp + 0x270], xmm1
mov byte [rbp + 0x260], r14b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov edx, eax
cmp al, 0xa
je 0x140001ba9
nop dword [rax]
mov r8, qword [rbp + 0xe0]
mov r9, qword [rbp + 0xe8]
cmp r8, r9
jae 0x1400019dd
lea rcx, [r8 + 1]
mov qword [rbp + 0xe0], rcx
lea rax, [rbp + 0xd0]
cmp r9, 0x10
cmovae rax, qword [rbp + 0xd0]
mov byte [rax + r8], dl
mov byte [rax + r8 + 1], 0
jmp 0x1400019ed
movzx r9d, dl
lea rcx, [rbp + 0xd0]
call fcn.140003ed0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
movzx edx, al
cmp al, 0xa
jne 0x1400019a0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x150]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140006990]
mov qword [rbp + 0x150], rax
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp - 0x70], 3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x150]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x150]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x150], rax
mov rax, qword [rbp + 0x150]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x14c], edx
lea rcx, [rbp + 0x158]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x158], rax
mov byte [rbp + 0x1d4], 0
mov byte [rbp + 0x1c9], 0
lea rcx, [rbp + 0x158]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x1d8], r14
mov rax, qword [0x14000a988]
mov qword [rbp + 0x1cc], rax
mov qword [rbp + 0x1c0], r14
mov r8d, 2
lea rdx, str.appid.txt
lea rcx, [rbp + 0x158]
call fcn.1400035c0
xor r8d, r8d
test rax, rax
mov rax, qword [rbp + 0x150]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x150]
je 0x140001b17
add rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x140001b25
add rcx, rax
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
cmp qword [rbp + 0x1d8], 0
je 0x140001b69
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rdx, qword [rbp + 0xd0]
mov r8, qword [rbp + 0xe0]
lea rcx, [rbp + 0x150]
call fcn.140004050
mov rcx, rax
lea rdx, [0x1400039d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x158]
call fcn.140003510
test rax, rax
jne 0x140001b9d
mov rax, qword [rbp + 0x150]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x150]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp + 0x150]
call fcn.140002420
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.arguments.txt
lea rcx, [rbp - 0x40]
call fcn.140003100
nop
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x40]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x140001c11
lea rdx, [0x1400066d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003bf0
mov rcx, rax
lea rdx, [0x1400039d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edi, 1
jmp 0x140002263
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], 0
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x40]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x40]
call fcn.140004210
lea rcx, [rbp - 0x30]
call fcn.140003510
test rax, rax
jne 0x140001c89
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r14, qword [rbp + 0x140]
sub rax, r14
cmp rax, 1
jb 0x140002344
lea r12, [rbp + 0x130]
mov r15, qword [rbp + 0x130]
mov r13, qword [rbp + 0x148]
cmp r13, 0x10
cmovae r12, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea rsi, [r14 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x70]
cmp rsi, rbx
jbe 0x140001d68
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001d22
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400045b0
test rax, rax
je 0x140001d4b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001d63
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001d52
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002350
jmp 0x140001d07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001d61
call fcn.1400045b0
mov rdi, rax
jmp 0x140001d63
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rbx
mov byte [rdi], 0x20
lea rcx, [rdi + 1]
mov r8, r14
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r8
mov esi, 0x10
cmp rax, rsi
jb 0x140001e22
lea rax, [r8 + 0x10]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rcx, rsi
cmovae rbx, qword [rsp + 0x70]
lea rax, [0x1400065f8]
lea r14, str.Phasmophobia.exe
cmp rax, rbx
jbe 0x140001de5
lea rax, [rbx + r8]
cmp r14, rax
ja 0x140001de5
cmp rbx, r14
ja 0x140001ddd
xor edi, edi
jmp 0x140001de8
mov rdi, rbx
sub rdi, r14
jmp 0x140001de8
mov rdi, rsi
lea rcx, [rbx + 0x10]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
sub rsi, rdi
lea rdx, [r14 + 0x10]
add rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x70]
jmp 0x140001e34
mov qword [rsp + 0x28], rsi
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.1400043b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140001eaf
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001eaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001eaa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400045ec
movdqa xmm0, xmmword [0x1400069c0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
lea rdx, [rbp + 0x110]
cmp qword [rbp + 0x128], 0x10
cmovae rdx, qword [rbp + 0x110]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x280]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, 1
test eax, eax
jne 0x140001f40
lea rdx, str.Failed_to_create_the_target_process.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003bf0
mov rcx, rax
lea rdx, [0x1400039d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400021c0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov r8d, 0x104
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x140001fba
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_allocate_remote_memory_for_the_first_DLL._Error_code:
mov ebx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003bf0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400039d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, edi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400021c0
mov qword [rsp + 0x20], r14
mov r9d, 0xf
lea r8, str.SteamFix64.dll
mov rdx, rsi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001fef
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_write_remote_memory_for_the_first_DLL._Error_code:
jmp 0x14000210c
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
jne 0x14000202e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_create_remote_thread_for_the_first_DLL._Error_code:
jmp 0x14000210c
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov r8d, 0x104
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x1400020a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_allocate_remote_memory_for_the_second_DLL._Error_code:
jmp 0x140001f80
mov qword [rsp + 0x20], r14
mov r9d, 0xb
lea r8, str.freetp.dll
mov rdx, rsi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400020d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_write_remote_memory_for_the_second_DLL._Error_code:
jmp 0x14000210c
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
jne 0x140002159
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_create_remote_thread_for_the_second_DLL._Error_code:
mov ebx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003bf0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400039d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, edi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400021c0
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Both_DLLs_injected_successfully_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003bf0
mov rcx, rax
lea rdx, [0x1400039d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edi, r14d
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x140002204
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400021ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400045ec
movdqa xmm0, xmmword [0x1400069c0]
movdqu xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x110], 0
cmp r13, 0x10
jb 0x140002255
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000224d
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000224d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400045ec
mov r13, qword [rbp + 0x108]
mov r12, qword [rbp + 0xf0]
lea rcx, [rbp - 0x40]
call fcn.140002360
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x1400022b1
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400045ec
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 0xf
mov byte [rbp + 0xd0], 0
lea rcx, [rbp + 0x2f0]
call fcn.140002360
nop
cmp r13, 0x10
jb 0x140002312
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14000230a
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000230a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.1400045ec
mov eax, edi
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140004590
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.1400011b0
int3