Function at 0x1800020c0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Get kernel32 base address
Get process filename

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4cc70]
mov eax, 0x4cd70
call fcn.1800051a0
sub rsp, rax
mov rax, qword [0x18000a040]
xor rax, rsp
mov qword [rbp + 0x4cc60], rax
mov rsi, rcx
mov qword [rsp + 0x30], rcx
movsd xmm0, qword [0x180006568]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x180006570]
mov dword [rsp + 0x68], eax
movzx eax, word [0x180006574]
mov word [rsp + 0x6c], ax
movzx eax, byte [0x180006576]
mov byte [rsp + 0x6e], al
movsd xmm0, qword [str.CreateEventW]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [0x180006580]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x180006584]
mov byte [rsp + 0x5c], al
xor r13d, r13d
mov qword [rsp + 0x40], r13
mov rdi, qword gs:[0x60]
mov rax, qword [rdi + 0x18]
add rax, 0x20
mov rbx, qword [rax]
cmp rbx, rax
je 0x1800021aa
nop dword [rax]
lea rdx, str.KERNELBASE.dll
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x180002254
mov rbx, qword [rbx]
mov rax, qword [rdi + 0x18]
add rax, 0x20
cmp rbx, rax
jne 0x180002180
lea rdx, [0x1800065a8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003aa0
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.180003aa0
mov rcx, rax
lea rdx, [0x180003c70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsi]
test rcx, rcx
je 0x18000221f
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18000220f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002714
mov rcx, r8
call fcn.180004170
mov qword [rsi], r13
mov qword [rsi + 8], r13
mov qword [rsi + 0x10], r13
mov eax, 0xfffffffe
mov rcx, qword [rbp + 0x4cc60]
xor rcx, rsp
call fcn.180004150
lea r11, [rsp + 0x4cd70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x1800021aa
lea rdx, [0x1800065c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003aa0
mov rcx, rax
lea rdx, [0x180003c70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call fcn.180001cc0
mov rdi, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x1800022b7
lea rdx, str.___
call fcn.180003aa0
mov rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
jmp 0x1800021ca
lea rdx, str.__
call fcn.180003aa0
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x180003c70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x18bc
lea rcx, str.___Trying_to_open_process_with_pid:__d_n
call fcn.180001040
xor edx, edx
mov ecx, 0x1fffff
mov r8d, 0x18bc
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
mov edx, 0x18bc
test rax, rax
jne 0x18000231e
lea rcx, str.___ERROR__Could_not_open_process_with_pid__d_n
call fcn.180001040
jmp 0x18000239b
lea rcx, str._____Successfully_opened_process_with_pid__d_n_n
call fcn.180001040
lea rcx, str.___Trying_to_find_memory_holes_n
call fcn.180001040
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
mov r14, rdi
and r14, 0xfffffffffff70000
sub r14, 0x70000000
lea rbx, [rdi + 0x70000000]
cmp r14, rbx
jae 0x18000238e
add eax, 0x38
movsxd r12, eax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, r12
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
jne 0x1800023e9
add r14, 0x10000
cmp r14, rbx
jb 0x180002360
lea rcx, str.___Error__Could_not_find_memory_hole_n
call fcn.180001040
nop
mov rcx, qword [rsi]
test rcx, rcx
je 0x1800023df
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800023cf
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002714
mov rcx, r8
call fcn.180004170
mov qword [rsi], r13
mov qword [rsi + 8], r13
mov qword [rsi + 0x10], r13
mov eax, 0xffffff9d
jmp 0x180002224
mov rdx, r14
lea rcx, str._____Found_Memory_Hole:__p_n
call fcn.180001040
test r14, r14
je 0x18000238e
lea rdx, str.___VirtualAlloc_memory_success_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003aa0
mov rcx, rax
lea rdx, [0x180003c70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0x50]
lea rcx, str.___Reading_bytes_from_the_memory_address_of__s_n
call fcn.180001040
mov rbx, qword [rdi]
mov r8, rbx
mov rdx, rdi
lea rcx, str._____Address__p_has_value___lld_n_n
call fcn.180001040
lea rcx, str.___Generating_hook
call fcn.180001040
mov qword [0x18000a0ba], rbx
lea rcx, str._____Hook_successfully_placed
call fcn.180001040
lea rdx, [rsp + 0x50]
lea rcx, str.___Changing_the_memory_protection_of__s_to_RWX_n
call fcn.180001040
mov dword [rsp + 0x38], r13d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1800024ab
lea rcx, str.___Error__Could_not_change_the_memory_protection_settings_n
jmp 0x180002395
lea rdx, [rsp + 0x50]
lea rcx, str._____Successfully_changed_the_memory_protection_settings_of__s_to_RWX_n
call fcn.180001040
lea rcx, str.___Trying_to_inject_the_call_assembly_for_the_exported_function_n
call fcn.180001040
mov eax, r14d
sub eax, edi
sub eax, 5
mov byte [rsp + 0x48], 0xe8
mov dword [rsp + 0x49], eax
mov qword [rsp + 0x20], r13
mov r9d, 0x40
lea r8d, [r9 - 0x3b]
lea rdx, [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 5
lea r8, [rsp + 0x48]
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rsp + 0x50]
test eax, eax
jne 0x180002531
lea rcx, str.___Error__Could_redirect__s_n
call fcn.180001040
jmp 0x18000239b
lea rcx, str._____Successfully_modified__s_function_to_call_the_custom_shellcode_n
call fcn.180001040
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
sub rbx, rdi
lea rdx, [0x180006900]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003aa0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x1800068f8]
call fcn.180003aa0
mov rdx, rdi
mov rcx, rax
call fcn.180003aa0
mov rcx, rax
lea rdx, [0x180003c70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8, qword [rsi]
mov r9, qword [rsi + 8]
sub r9, r8
movups xmm0, xmmword [0x18000a0a8]
movaps xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x18000a0b8]
movaps xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [0x18000a0c8]
movaps xmmword [rbp - 0x70], xmm0
movsd xmm1, qword [0x18000a0d8]
movsd qword [rbp - 0x60], xmm1
mov rdx, r13
je 0x1800025f6
lea rax, [rbp - 0x58]
sub r8, rax
nop word [rax + rax]
lea rcx, [rbp - 0x58]
add rcx, rdx
movzx eax, byte [r8 + rcx]
mov byte [rcx], al
inc rdx
cmp rdx, r9
jb 0x1800025e0
lea r8, [rsp + 0x70]
mov edx, 0x4ccee
lea rcx, [0x180006910]
call fcn.180001040
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8d, 0x4ccee
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdx, r14
test eax, eax
jne 0x180002646
lea rcx, str._Error__Modifying_the_memory_protection_of_the_memory_hole:__p_before_write_n
call fcn.180001040
jmp 0x18000239b
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x4ccee
lea r8, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, r14
test eax, eax
jne 0x18000267c
lea rcx, str._Error__Writing_to_the_memory_hole_address:__p_n
call fcn.180001040
jmp 0x18000239b
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov r8d, 0x4ccee
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1800026b3
mov rdx, r14
lea rcx, str._Error__Modifying_the_memory_protection_of_the_memory_hole:__p_after_write_n
call fcn.180001040
jmp 0x18000239b
lea rcx, str._n___Injection_successful__wait_for_your_trigger_function__n
call fcn.180001040
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rcx, qword [rsi]
test rcx, rcx
je 0x180002224
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800026ff
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002714
mov rcx, r8
call fcn.180004170
mov qword [rsi], r13
mov qword [rsi + 8], r13
mov qword [rsi + 0x10], r13
jmp 0x180002224
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3