Function at 0x140001230
Capabilities:
Acquire debug privileges
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov ebx, ecx
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x78], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x60]
lea edx, [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001710
lea r8, [rbp - 0x78]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140001710
mov dword [rbp - 0x70], 1
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x6c], rax
mov dword [rbp - 0x64], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9d, [r12 + 0x10]
lea r8, [rbp - 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140001710
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140001710
mov r8d, 0x104
lea rdx, [rbp + 0xd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rbp + 0xd0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140001345
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x40]
call fcn.140001910
lea rsi, [rsp + 0x40]
mov r14, qword [rsp + 0x40]
mov r15, qword [rsp + 0x58]
cmp r15, 0x10
cmovae rsi, r14
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x1400013e7
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x140004404]
lea rdx, [0x140004406]
nop
movzx eax, byte [rcx]
mov byte [rbp + rax - 0x30], 1
inc rcx
cmp rcx, rdx
jne 0x1400013a0
lea rax, [rbx - 1]
mov rbx, rdi
cmp rax, rbx
cmovb rbx, rax
add rbx, rsi
movzx eax, byte [rbx]
cmp byte [rbp + rax - 0x30], r12b
jne 0x1400013e2
nop dword [rax + rax]
cmp rbx, rsi
je 0x1400013e7
dec rbx
movzx eax, byte [rbx]
cmp byte [rbp + rax - 0x30], r12b
je 0x1400013d0
sub rbx, rsi
jmp 0x1400013ea
mov rbx, rdi
cmp r15, 0x10
jb 0x140001424
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000141c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000141c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140002bbc
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rax, [rbp + 0xd0]
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x140001440
mov r8, rdi
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x70]
call fcn.140001910
nop
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.1400017b0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1400014ac
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400016b8
call fcn.140002bbc
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r15, qword [rbp - 0x40]
sub rax, r15
cmp rax, 0xb
jb 0x140001740
lea r13, [rbp - 0x50]
mov rsi, qword [rbp - 0x50]
mov r14, qword [rbp - 0x38]
cmp r14, 0x10
cmovae r13, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
lea r12, [r15 + 0xb]
mov ebx, 0xf
lea rdi, [rsp + 0x68]
cmp r12, rbx
jbe 0x14000157c
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000153e
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002b80
test rax, rax
je 0x1400016b8
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001577
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001566
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001746
jmp 0x14000151f
test rcx, rcx
je 0x140001575
call fcn.140002b80
mov rdi, rax
jmp 0x140001577
xor edi, edi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], rbx
mov r8, r15
mov rdx, r13
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str._stitch.dll]
movsd qword [r15 + rdi], xmm0
movzx eax, word [0x140004410]
mov word [r15 + rdi + 8], ax
movzx eax, byte [0x140004412]
mov byte [r15 + rdi + 0xa], al
mov byte [rdi + r12], 0
mov r8, qword [rsp + 0x78]
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
lea r8, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x78]
inc r9
xor r15d, r15d
mov qword [rsp + 0x20], r15
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
jne 0x140001667
lea rcx, str.Failed_to_create_remote_thread_n
call fcn.140001010
jmp 0x140001685
lea rcx, str.Injected_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400016c4
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002bbc
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], r15b
cmp r14, 0x10
jb 0x140001710
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001708
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001708
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140002bbc
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140002b60
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001210
nop
call fcn.140001170
int3