Function at 0x140003b10
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r14d, r14d
mov r15d, r14d
mov dword [rsp + 0x40], r14d
nop dword [rax]
lea rcx, [rbp - 0x19]
call fcn.140001810
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140003b9f
mov rax, qword [rbp - 9]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040fb
call fcn.140004f00
mov rax, qword [0x14000a0b8]
mov rdx, qword [0x14000a0c0]
cmp rax, rdx
je 0x1400040de
sub rdx, rax
sar rdx, 2
lea rcx, str.Found_x64dbg_processes:__u___
call fcn.140003030
mov r12, qword [0x14000a0b8]
mov r13, qword [0x14000a0c0]
cmp r12, r13
je 0x14000403a
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rbp - 0x71], r14
mov qword [rbp - 0x69], 7
mov word [rsp + 0x48], r14w
or r15d, 2
mov dword [rsp + 0x40], r15d
mov edx, 0x104
mov r9d, edx
lea rcx, [rsp + 0x48]
call fcn.140004960
nop word [rax + rax]
mov esi, dword [rbp - 0x71]
lea rdx, [rsp + 0x48]
cmp qword [rbp - 0x69], 7
cmova rdx, qword [rsp + 0x48]
mov ecx, esi
call fcn.140004de8
mov rbx, rax
mov qword [rbp - 0x19], rax
mov ecx, eax
mov r8, qword [rbp - 0x71]
cmp rcx, r8
ja 0x140003c67
mov qword [rbp - 0x71], rcx
lea rax, [rsp + 0x48]
cmp qword [rbp - 0x69], 7
cmova rax, qword [rsp + 0x48]
mov word [rax + rcx*2], r14w
jmp 0x140003cba
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp - 0x69]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140003cad
mov qword [rbp - 0x71], rcx
lea r9, [rsp + 0x48]
cmp rdi, 7
cmova r9, qword [rsp + 0x48]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140003ca2
movzx eax, r14w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r14w
jmp 0x140003cba
mov r9, rdx
lea rcx, [rsp + 0x48]
call fcn.140004960
cmp ebx, esi
jae 0x140003c20
mov eax, dword [rbp - 0x15]
mov dword [rbp - 0x39], eax
lea rcx, [0x14000a0a8]
mov qword [rbp - 0x31], rcx
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x19], xmm0
and r15d, 0xfffffffd
or r15d, 1
mov dword [rsp + 0x40], r15d
test eax, eax
jne 0x140004117
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x61]
call fcn.140004210
or r15d, 4
mov dword [rsp + 0x40], r15d
mov rbx, qword [rbp - 0x51]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
sub rax, rbx
cmp rax, 0xd
jb 0x140003d53
lea rax, [rbx + 0xd]
mov qword [rbp - 0x51], rax
lea rdi, [rbp - 0x61]
cmp rcx, 7
cmova rdi, qword [rbp - 0x61]
lea rcx, [rdi + rbx*2]
mov r8d, 0x1a
lea rdx, str.infector.dll
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rbx*2 + 0x1a], r14w
lea rax, [rbp - 0x61]
jmp 0x140003d6a
mov qword [rsp + 0x20], 0xd
mov edx, 0xd
lea rcx, [rbp - 0x61]
call fcn.140004580
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 7], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x17], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or r15d, 8
mov rdx, qword [rbp - 0x49]
cmp rdx, 7
jbe 0x140003ddc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003dd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004102
call fcn.140004f00
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r14w
and r15d, 0xfffffffe
mov rdx, qword [rbp - 0x69]
cmp rdx, 7
jbe 0x140003e32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004109
call fcn.140004f00
lea r14, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova r14, qword [rbp + 7]
mov r8d, dword [r12]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [r14 + rdi*2], 0
jne 0x140003e60
add rdi, rdi
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rdi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
mov rcx, rbx
test rax, rax
jne 0x140003ea6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r14d, r14d
mov eax, r14d
jmp 0x140003faf
mov qword [rsp + 0x20], 0
mov r9, rdi
mov r8, r14
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140003eeb
xor r8d, r8d
mov rcx, rbx
mov rdx, rsi
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r14d, r14d
mov eax, r14d
jmp 0x140003faf
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003ec2
lea rdx, str.LoadLibraryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
mov rcx, rbx
test rax, rax
je 0x140003ec8
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
mov r9, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
jne 0x140003f60
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
jmp 0x140003faf
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rbp - 0x29], r14d
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
cmp dword [rbp - 0x29], eax
setne al
lea r8, str._NOT_INFECTED_
test eax, eax
lea rax, str._INFECTED_
cmovne r8, rax
mov edx, dword [r12]
lea rcx, str._u__s_n
call fcn.140003030
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x140004013
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000400e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004110
call fcn.140004f00
add r12, 4
cmp r12, r13
jne 0x140003be0
mov r13, qword [0x14000a0c0]
mov r12, qword [0x14000a0b8]
cmp r12, r13
je 0x14000403a
mov qword [0x14000a0c0], r12
mov rax, r12
cmove rax, r13
mov rdx, qword [0x14000a0c8]
cmp rax, rdx
je 0x1400040eb
cmp r12, rax
jne 0x1400040ba
test r12, r12
je 0x1400040eb
sub rdx, r12
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x14000408d
add rdx, 0x27
mov rcx, qword [r12 - 8]
sub r12, rcx
lea rax, [r12 - 8]
cmp rax, 0x1f
ja 0x140004121
mov r12, rcx
mov rcx, r12
call fcn.140004f00
mov qword [0x14000a0b8], r14
mov qword [0x14000a0c0], r14
mov qword [0x14000a0c8], r14
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003b50
sub rax, r12
sar rax, 2
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x19]
call fcn.140004840
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003b50
lea rcx, str.No_x64dbg_processes_found.
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003b50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rbp - 0x19]
call fcn.140003a90
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3