Function at 0x140001c2f
Capabilities:
Patch process command line

Disassembly:
push rbp
push rdi
sub rsp, 0x6a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x640], rcx
lea rdx, [rbp + 0x1c0]
mov eax, 0
mov ecx, 0x7e
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x1c0], 0x3f0
lea rax, [0x14003f1b3]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov rcx, rax
lea rax, str.NtQueryInformationProcess
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x618], rax
cmp qword [rbp + 0x618], 0
jne 0x140001cbb
lea rax, str.____Error:_Failed_to_resolve_NtQueryInformationProcess_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
mov r10, qword [rbp + 0x618]
lea rcx, [rbp + 0x5e0]
mov rax, qword [rbp + 0x640]
lea rdx, [rbp + 0x5dc]
mov qword [rsp + 0x20], rdx
mov r9d, 0x30
mov r8, rcx
mov edx, 0
mov rcx, rax
call r10
test eax, eax
setne al
test al, al
je 0x140001d1d
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Failed_to_query_process_information___d__n_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
mov rdx, qword [rbp + 0x5e8]
lea r8, [rbp + 0x5b0]
mov rax, qword [rbp + 0x640]
lea rcx, [rbp + 0x5d0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x18
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x140001d7d
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Failed_to_read_remote_PEB___d__n_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
mov rdx, qword [rbp + 0x5c0]
lea r8, [rbp + 0x1c0]
mov rax, qword [rbp + 0x640]
lea rcx, [rbp + 0x5d0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x3f0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x140001ddd
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Failed_to_read_remote_process_parameters___d__n_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
movzx eax, word [rbp + 0x1fa]
movzx eax, ax
mov edx, eax
lea rax, str._i__Maximum_Length_for_CurrentDirectory:__d_n_n
mov rcx, rax
call dbg.printf
movzx eax, word [rbp + 0x222]
movzx eax, ax
mov edx, eax
lea rax, str._i__Maximum_Length_for_ImagePathName:__d_n_n
mov rcx, rax
call dbg.printf
mov rax, qword [rbp + 0x228]
mov rdx, rax
lea rax, str._i__ImagePathName_Buffer_Pointer:__p_n_n
mov rcx, rax
call dbg.printf
mov rdx, qword [rbp + 0x228]
mov rax, qword [rbp + 0x640]
mov rcx, rax
call dbg.IsMemoryAccessible(void*, void const*)
test al, al
je 0x140001ecb
mov rdx, qword [rbp + 0x228]
lea r8, [rbp - 0x50]
mov rax, qword [rbp + 0x640]
lea rcx, [rbp + 0x5d0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x208
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
test eax, eax
setne al
test al, al
je 0x140001eaf
movzx eax, word [rbp + 0x220]
movzx eax, ax
shr rax, 1
mov word [rbp + rax*2 - 0x50], 0
lea rax, [rbp - 0x50]
mov rdx, rax
lea rax, str._i__Existing_ImagePathName:__ls_n_n
mov rcx, rax
call dbg.printf
jmp 0x140001eda
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Failed_to_read_existing_ImagePathName_buffer___d__n_n
mov rcx, rax
call dbg.printf
jmp 0x140001eda
lea rax, str.____Error:_ImagePathName_Buffer_is_not_accessible._Check_permissions_or_process_state._n_n
mov rcx, rax
call dbg.printf
lea rax, str.C:WindowsTemp_
mov rcx, rax
call sym.wcslen
add eax, eax
mov word [rbp + 0x1be], ax
lea rax, str.C:WindowsSystem32_notepad.exe
mov rcx, rax
call sym.wcslen
add eax, eax
mov word [rbp + 0x1bc], ax
lea rax, str.C:WindowsSystem32_notepad.exe
mov rcx, rax
call sym.wcslen
add eax, eax
mov word [rbp + 0x1ba], ax
movzx eax, word [rbp + 0x1fa]
test ax, ax
je 0x140002035
movzx edx, word [rbp + 0x1fa]
movzx eax, word [rbp + 0x1be]
cmp dx, ax
jae 0x140001f69
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Could_not_update_CurrentDirectory___new_value_too_long___d__n_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
movzx eax, word [rbp + 0x1be]
movzx r8d, ax
mov rdx, qword [rbp + 0x200]
mov rax, qword [rbp + 0x640]
lea rcx, [rbp + 0x5d0]
mov qword [rsp + 0x20], rcx
mov r9, r8
lea r8, str.C:WindowsTemp_
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x140001fd1
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Failed_to_write_CurrentDirectory___d__n_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
lea r8, [rbp + 0x1be]
lea rax, [rbp + 0x1c0]
lea rdx, [rax + 0x38]
mov rax, qword [rbp + 0x640]
lea rcx, [rbp + 0x5d0]
mov qword [rsp + 0x20], rcx
mov r9d, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x140002044
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Failed_to_update_CurrentDirectory_length___d__n_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
lea rax, str._i__Current_Directory_not_set_or_invalid._Skipping_modification_for_CurrentDirectory._n_n
mov rcx, rax
call dbg.printf
movzx edx, word [rbp + 0x222]
movzx eax, word [rbp + 0x1bc]
cmp dx, ax
jae 0x14000207b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Could_not_update_ImagePathName___new_value_too_long___d__n_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
mov rdx, qword [rbp + 0x228]
mov rax, qword [rbp + 0x640]
mov rcx, rax
call dbg.IsMemoryAccessible(void*, void const*)
test al, al
je 0x140002165
movzx eax, word [rbp + 0x1bc]
movzx r8d, ax
mov rdx, qword [rbp + 0x228]
mov rax, qword [rbp + 0x640]
lea rcx, [rbp + 0x5d0]
mov qword [rsp + 0x20], rcx
mov r9, r8
lea r8, str.C:WindowsSystem32_notepad.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x140002101
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Failed_to_write_ImagePathName___d__n_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
lea r8, [rbp + 0x1bc]
lea rax, [rbp + 0x1c0]
lea rdx, [rax + 0x60]
mov rax, qword [rbp + 0x640]
lea rcx, [rbp + 0x5d0]
mov qword [rsp + 0x20], rcx
mov r9d, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x140002174
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Failed_to_update_ImagePathName_length___d__n_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
lea rax, str.____Error:_ImagePathName_Buffer_is_not_accessible._Skipping_modification_for_ImagePathName._n_n
mov rcx, rax
call dbg.printf
movzx edx, word [rbp + 0x232]
movzx eax, word [rbp + 0x1ba]
cmp dx, ax
jae 0x1400021ab
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Could_not_update_CommandLine___new_value_too_long___d__n_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
movzx eax, word [rbp + 0x1ba]
movzx r8d, ax
mov rdx, qword [rbp + 0x238]
mov rax, qword [rbp + 0x640]
lea rcx, [rbp + 0x5d0]
mov qword [rsp + 0x20], rcx
mov r9, r8
lea r8, str.C:WindowsSystem32_notepad.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x140002210
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Failed_to_write_CommandLine___d__n_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
lea r8, [rbp + 0x1ba]
lea rax, [rbp + 0x1c0]
lea rdx, [rax + 0x70]
mov rax, qword [rbp + 0x640]
lea rcx, [rbp + 0x5d0]
mov qword [rsp + 0x20], rcx
mov r9d, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x140002271
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Error:_Failed_to_update_CommandLine_length___d__n_n
mov rcx, rax
call dbg.printf
mov eax, 1
jmp 0x140002276
mov eax, 0
add rsp, 0x6a8
pop rdi
pop rbp
ret