Function at 0x140001400
Capabilities:
Accept command line arguments
Create process on windows
Create thread
Inject dll
Inject thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x378]
sub rsp, 0x478
mov rax, qword [0x140008018]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x68], rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r12d, r12d
mov rdi, 0xffffffffffffffff
mov qword [rbp + 0xb0], r12
mov r8, rdi
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], r12
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x140001460
mov rdx, rax
mov qword [rsp + 0x470], r15
lea rcx, [rbp + 0xb0]
call fcn.1400025a0
mov r14, qword [rbp + 0xc8]
lea r9, [rbp + 0xb0]
mov rsi, qword [rbp + 0xb0]
cmp r14, 8
mov r11, qword [rbp + 0xc0]
cmovae r9, rsi
cmp r11, 2
jb 0x1400014e4
lea r10, [r11 - 1]
mov rbx, r9
lea r10, [r9 + r10*2]
lea r15, [0x140005624]
nop dword [rax]
mov rax, r10
sub rax, rbx
sar rax, 1
je 0x1400014e4
nop dword [rax + rax]
cmp word [rbx], 0x22
je 0x140001660
add rbx, 2
sub rax, 1
jne 0x1400014d0
mov rbx, rdi
inc rbx
mov qword [rbp + 0x50], r12
cmp r11, rbx
mov qword [rbp + 0x60], r12
mov r8, rbx
mov qword [rbp + 0x68], r12
cmovb r8, r11
lea rdx, [rbp + 0xb0]
cmp r14, 8
lea rcx, [rbp + 0x50]
cmovae rdx, rsi
call fcn.1400025a0
mov rax, qword [rbp + 0xc0]
inc rbx
mov qword [rbp + 0xd0], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
cmp rax, rbx
jb 0x140001f04
sub rax, rbx
lea rcx, [rbp + 0xd0]
cmp rax, rdi
mov r8, rdi
cmovb r8, rax
cmp qword [rbp + 0xc8], 8
lea rax, [rbp + 0xb0]
cmovae rax, qword [rbp + 0xb0]
lea rdx, [rax + rbx*2]
call fcn.1400025a0
mov rbx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
mov eax, 1
cmp rbx, rax
cmovb rax, rbx
cmp qword [rbp + 0x68], 8
cmovae rcx, qword [rbp + 0x50]
sub rbx, rax
lea r8, [rbx*2 + 2]
lea rdx, [rcx + rax*2]
call sub.VCRUNTIME140.dll_memmove
lea rdx, [rbx - 1]
mov qword [rbp + 0x60], rbx
cmp rbx, rdx
jb 0x140001f04
cmp qword [rbp + 0x68], 8
lea rcx, [rbp + 0x50]
lea r9, [rbp + 0x50]
cmovae rcx, qword [rbp + 0x50]
movzx eax, word [rcx + rdx*2 + 2]
mov word [rcx + rdx*2], ax
mov r11, qword [rbp + 0x68]
mov r10, qword [rbp + 0x50]
cmp r11, 8
mov qword [rbp + 0x60], rdx
cmovae r9, r10
cmp rdx, 8
jb 0x1400016ba
lea rcx, [rdx - 8]
mov rax, rdi
cmp rcx, rax
lea rsi, str.H1Z1.exe
cmovb rax, rcx
lea rbx, [r9 + rax*2]
mov r8, rbx
sub r8, rsi
nop dword [rax]
cmp word [rbx], 0x48
jne 0x1400016a8
mov edx, 8
mov rcx, rsi
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400016a8
add rcx, 2
sub rdx, 1
jne 0x140001622
sub rbx, r9
sar rbx, 1
cmp rbx, rdi
je 0x1400016bd
mov rdx, rbx
mov qword [rsp + 0x20], 9
lea rcx, [rbp + 0x50]
call fcn.140001f90
mov r11, qword [rbp + 0x68]
mov r10, qword [rbp + 0x50]
jmp 0x1400016bd
test rbx, rbx
je 0x1400014e4
mov r8, rbx
mov edx, 2
sub r8, r15
mov rcx, r15
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x14000169f
add rcx, 2
sub rdx, 1
jne 0x140001680
sub rbx, r9
sar rbx, 1
jmp 0x1400014e7
add rbx, 2
jmp 0x1400014c0
cmp rbx, r9
je 0x1400016ba
sub rbx, 2
sub r8, 2
jmp 0x140001610
mov rbx, rdi
xorps xmm0, xmm0
mov qword [rsp + 0x4b8], r13
movups xmmword [rbp - 0x60], xmm0
cmp r11, 8
lea rax, str.open
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x70]
movups xmmword [rbp - 0x70], xmm0
lea rax, [rbp + 0x50]
mov dword [rbp - 0x70], 0x70
cmovae rax, r10
mov dword [rbp - 0x6c], 0x40
cmp qword [rbp + 0xe8], 8
mov qword [rbp - 0x58], rax
lea rax, [rbp + 0xd0]
cmovae rax, qword [rbp + 0xd0]
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x40], 5
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x50], rax
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x38], r12
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140001d99
cmp qword [rbp - 8], r12
je 0x140001d99
mov r8d, 0x104
lea rdx, [rbp + 0x250]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140001786
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_get_module_file_name._n
call fcn.1400021c0
mov r14d, 1
jmp 0x140001dd2
mov qword [rbp + 0x70], r12
lea rax, [rbp + 0x250]
mov qword [rbp + 0x80], r12
mov r8, rdi
mov qword [rbp + 0x88], r12
inc r8
cmp byte [rax + r8], r12b
jne 0x1400017a2
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x70]
call fcn.1400026e0
mov r12, qword [rbp + 0x88]
lea rsi, [rbp + 0x70]
mov r15, qword [rbp + 0x70]
cmp r12, 0x10
mov r14, qword [rbp + 0x80]
cmovae rsi, r15
test r14, r14
je 0x14000184e
xor edx, edx
lea rcx, [rbp + 0x120]
mov r8d, pe_nt_image_headers64
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x1400056ac]
lea rdx, [0x1400056ae]
movzx eax, byte [rcx]
inc rcx
mov byte [rbp + rax + 0x120], 1
cmp rcx, rdx
jne 0x140001800
lea rax, [r14 - 1]
mov r8, rdi
cmp rax, rdi
cmovb r8, rax
add r8, rsi
movzx eax, byte [r8]
cmp byte [rbp + rax + 0x120], 0
jne 0x140001849
cmp r8, rsi
je 0x14000184e
movzx eax, byte [r8 - 1]
dec r8
cmp byte [rbp + rax + 0x120], 0
je 0x140001832
sub r8, rsi
jmp 0x140001851
mov r8, rdi
cmp rbx, rdi
je 0x1400018ec
cmp r14, r8
mov qword [rsp + 0x70], 0
xorps xmm0, xmm0
lea rdx, [rbp + 0x70]
cmovb r8, r14
lea rcx, [rsp + 0x70]
cmp r12, 0x10
movdqu xmmword [rbp - 0x80], xmm0
cmovae rdx, r15
call fcn.1400026e0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x1400018c6
mov rcx, qword [rbp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018c1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001eba
call fcn.140003c5c
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rbp + 0x70], xmm0
mov r15, qword [rbp + 0x70]
movups xmmword [rbp + 0x80], xmm1
mov r12, qword [rbp + 0x88]
mov r14, qword [rbp + 0x80]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0xd
jb 0x140001ef8
cmp r12, 0x10
lea r13, [rbp + 0x70]
mov ebx, 0xf
lea rsi, [rbp + 0x90]
cmovae r13, r15
xorps xmm0, xmm0
xor r12d, r12d
lea r15, [r14 + 0xd]
mov qword [rbp + 0x90], r12
movdqu xmmword [rbp + 0xa0], xmm0
cmp r15, rbx
jbe 0x1400019bd
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000197c
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140003c20
test rax, rax
je 0x140001eba
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400019b6
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400019a4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001efe
jmp 0x14000195d
test rcx, rcx
je 0x1400019b3
call fcn.140003c20
mov rsi, rax
jmp 0x1400019b6
mov rsi, r12
mov qword [rbp + 0x90], rsi
mov r8, r14
mov qword [rbp + 0xa0], r15
mov rdx, r13
mov qword [rbp + 0xa8], rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str._fairplay.dll]
mov r8, rdi
movsd qword [rsi + r14], xmm0
mov eax, dword [0x1400056b8]
mov dword [rsi + r14 + 8], eax
movzx eax, byte [0x1400056bc]
mov byte [rsi + r14 + 0xc], al
lea rax, [rbp + 0x90]
mov byte [rsi + r15], r12b
cmp qword [rbp + 0xa8], 0x10
cmovae rax, qword [rbp + 0x90]
nop dword [rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x140001a20
mov rcx, qword [rbp - 8]
inc r8
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x140001ce8
cmp qword [rbp + 0xa8], 0x10
lea r9, [rbp + 0x90]
lea r8, [rbp + 0x90]
cmovae r9, qword [rbp + 0x90]
cmovae r8, qword [rbp + 0x90]
nop dword [rax + rax]
cmp byte [r9 + rdi + 1], r12b
lea rdi, [rdi + 1]
jne 0x140001a80
mov rcx, qword [rbp - 8]
lea r9, [rdi + 1]
mov rdx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001aeb
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400056c0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp - 8]
xor r8d, r8d
mov qword [rsp + 0x30], r12
mov r9, rax
mov dword [rsp + 0x28], r12d
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
jne 0x140001b06
mov rcx, qword [rbp - 8]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140001ce8
movups xmm0, xmmword [str.Sample_Window_Class]
mov r15, qword [rsp + 0x68]
lea rax, [0x1400011e0]
movups xmm1, xmmword [0x1400056f8]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x220]
movups xmmword [rbp + 0x220], xmm0
lea rcx, [rbp]
mov qword [rbp], r12
movsd xmm0, qword [0x140005708]
movsd qword [rbp + 0x240], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm1
mov qword [rbp + 0x10], r12
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x30], xmm1
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x40], rax
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], r12
lea r8, str.Sample_Application
add eax, 0xfffffed4
mov qword [rsp + 0x50], r15
cdq
mov qword [rsp + 0x48], r12
sub eax, edx
mov qword [rsp + 0x40], r12
sar eax, 1
mov r9d, 0xcf0000
mov ecx, eax
mov dword [rsp + 0x38], 0x12c
lea eax, [rbx - 0x1f4]
mov dword [rsp + 0x30], 0x1f4
cdq
mov dword [rsp + 0x28], ecx
sub eax, edx
xor ecx, ecx
sar eax, 1
lea rdx, [rbp + 0x220]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rbx, rax
test rax, rax
je 0x140001ce8
mov edx, dword [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
xorps xmm0, xmm0
lea rcx, [rbp + 0xf0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140001c73
nop word [rax + rax]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp + 0xf0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140001c40
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Executable_launched__process_handle:
call fcn.1400023d0
mov rdx, qword [rbp - 8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140005738]
call fcn.1400023d0
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 8]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0xa8]
mov r14d, r12d
cmp rdx, 0x10
jb 0x140001d2c
mov rcx, qword [rbp + 0x90]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d27
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001eba
call fcn.140003c5c
mov rdx, qword [rbp + 0x88]
movdqa xmm0, xmmword [0x1400057c0]
mov byte [rbp + 0x90], r12b
movdqu xmmword [rbp + 0xa0], xmm0
cmp rdx, 0x10
jb 0x140001d81
mov rcx, qword [rbp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d7c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001eba
call fcn.140003c5c
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], r12b
jmp 0x140001dd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.ShellExecuteEx_failed:
mov ebx, eax
call fcn.1400021c0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002390]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r14d, edi
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x140001e18
mov rcx, qword [rbp + 0xd0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e13
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001eba
call fcn.140003c5c
mov rdx, qword [rbp + 0x68]
movdqa xmm0, xmmword [0x1400057b0]
mov word [rbp + 0xd0], r12w
movdqu xmmword [rbp + 0xe0], xmm0
cmp rdx, 8
jb 0x140001e6c
mov rcx, qword [rbp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e67
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001eba
call fcn.140003c5c
mov rdx, qword [rbp + 0xc8]
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r12w
cmp rdx, 8
jb 0x140001ec6
mov rcx, qword [rbp + 0xb0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ec1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ec1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003c5c
mov r13, qword [rsp + 0x4b8]
mov eax, r14d
mov r15, qword [rsp + 0x470]
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.140003c00
add rsp, 0x478
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400011c0
int3
call fcn.140001120
int3
call fcn.1400021a0
int3