Function at 0x1400089b0
Capabilities:
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x14000f040]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r15d, r15d
mov dword [rbp - 0x69], r15d
cmp ecx, 5
jne 0x140008a68
lea r8, [rdx + 8]
mov r9d, ecx
lea r11, str._proc
lea r10, str._dll
mov rdx, qword [r8 - 8]
mov rcx, r15
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r11 + rcx - 1]
jne 0x140008a30
cmp rcx, 6
jne 0x140008a10
mov rax, qword [r8]
mov qword [str.Target.exe], rax
jmp 0x140008a5e
mov rcx, r15
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r10 + rcx - 1]
jne 0x140008a5e
cmp rcx, 5
jne 0x140008a40
mov rax, qword [r8]
mov qword [str.Payload.dll], rax
add r8, 8
sub r9, 1
jne 0x140008a02
lea rax, [rbp - 0x61]
mov qword [rbp - 0x41], rax
mov rdx, qword [str.Payload.dll]
lea rcx, [rbp - 0x29]
call fcn.140005270
movups xmm6, xmmword [rbp - 0x29]
call fcn.14000928c
mov r14d, eax
movaps xmmword [rbp - 0x79], xmm6
lea rcx, [rbp - 0x61]
call fcn.140004b80
mov ebx, 4
mov dword [rbp - 0x69], ebx
cmp qword [rbp - 0x71], 0
je 0x140008b7e
lea rcx, [rbp - 0x79]
call fcn.140005230
cmp rax, 0x7fffffff
ja 0x140008d71
lea rcx, [rbp - 0x79]
call fcn.140005230
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rbp - 0x79]
mov ecx, r14d
call fcn.1400092b4
mov rsi, rax
shr rax, 0x20
test eax, eax
jne 0x140008d7c
movsxd rdi, esi
mov rax, qword [rbp - 0x51]
cmp rdi, rax
ja 0x140008b2a
mov word [rsp + 0x30], r15w
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 7
jbe 0x140008b16
mov rcx, qword [rbp - 0x61]
call fcn.140005220
mov qword [rbp - 0x51], rdi
lea rcx, [rax + rdi*2]
lea rdx, [rsp + 0x30]
call fcn.1400061c0
jmp 0x140008b39
sub rdi, rax
mov rdx, rdi
lea rcx, [rbp - 0x61]
call fcn.140008da0
lea rdi, [rbp - 0x61]
cmp qword [rbp - 0x49], 7
jbe 0x140008b50
mov rcx, qword [rbp - 0x61]
call fcn.140005220
mov rdi, rax
lea rcx, [rbp - 0x79]
call fcn.140005230
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, eax
mov rdx, qword [rbp - 0x79]
mov ecx, r14d
call fcn.1400092b4
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140008d88
lea rdx, [rbp - 0x61]
lea rcx, [rbp + 7]
call fcn.140008810
nop
lea rcx, [rbp - 0x61]
call fcn.140004a30
call fcn.140006900
lea rcx, [rbp + 7]
call fcn.140004940
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp - 0x19]
mov rcx, rax
call fcn.1400093f8
mov edi, eax
test eax, eax
jne 0x140008bee
mov edx, dword [rbp - 9]
bt edx, 0xa
jae 0x140008be0
mov eax, dword [rbp - 5]
cmp eax, 0xa000000c
je 0x140008c11
cmp eax, 0xa0000003
jne 0x140008be0
lea ebx, [rdi + 0xa]
jmp 0x140008c11
movzx ebx, dl
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
jmp 0x140008c11
mov dword [rbp - 0x3d], 0xffff
sub eax, 2
je 0x140008c0c
sub eax, 1
je 0x140008c0c
sub eax, 0x32
je 0x140008c0c
cmp eax, 0x46
mov ebx, r15d
jne 0x140008c11
mov ebx, 1
call fcn.140006900
mov dword [rbp - 0x79], edi
mov qword [rbp - 0x71], rax
movaps xmm0, xmmword [rbp - 0x79]
movdqa xmmword [rbp - 0x29], xmm0
test ebx, ebx
je 0x140008cfe
call fcn.140006900
cmp ebx, 1
je 0x140008d02
mov rbx, qword [str.Target.exe]
mov rcx, rbx
call fcn.140008fe0
mov edi, eax
mov rdx, rbx
test eax, eax
jne 0x140008c60
lea rcx, str.____Cant_get__s_PID_n
jmp 0x140008d10
mov r8d, edi
lea rcx, str.____s_PID:__d_n
call fcn.140001050
mov r8d, edi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140008c9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____OpenProcess_error:_0x_X_n
call fcn.140001050
jmp 0x140008d15
mov r8, rbx
mov rdx, qword [str.Target.exe]
lea rcx, str.____s_Handle:__p_n
call fcn.140001050
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
call fcn.140004a60
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.140002100
test al, al
jne 0x140008ce7
lea rcx, str.____Injection_error_n
call fcn.140001050
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140008d15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.___Injected__n
call fcn.140001050
jmp 0x140008d15
test edi, edi
jne 0x140008d5c
mov rdx, qword [str.Payload.dll]
lea rcx, str.____Cant_locate__s_n
call fcn.140001050
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rbp + 7]
call fcn.140004a30
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140009a40
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea r8, [rbp + 7]
lea rdx, [rbp - 0x29]
lea rcx, str.exists
call fcn.1400087b0
nop
mov ecx, 0x16
call fcn.140001530
int3
shr rsi, 0x20
mov ecx, esi
call fcn.1400017c0
int3
shr rcx, 0x20
call fcn.1400017c0
int3