Function at 0x140001230
Capabilities:
Create process on windows
Create thread
Enumerate processes
Get common file path
Inject dll
Inject thread

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x3a8]
sub rsp, 0x4a8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x390], rax
xorps xmm0, xmm0
mov dword [rbp - 0x30], 0x68
xor eax, eax
lea rdx, [rbp + 0x170]
mov ecx, 0x104
mov dword [rbp + 0x34], eax
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xorps xmm0, xmm0
lea rax, [rbp + 0x170]
mov rdi, 0xffffffffffffffff
movups xmmword [rbp - 0x50], xmm0
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400012a7
mov qword [rsp + 0x4d0], rsi
movabs r15, 0x7fffffffffffffff
mov qword [rsp + 0x4d8], r12
mov qword [rsp + 0x4e0], r13
mov qword [rsp + 0x4a0], r14
cmp rbx, r15
ja 0x1400019e1
mov r14d, 0xf
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp rbx, r14
ja 0x14000132e
mov r8, rbx
mov qword [rbp - 0x40], rbx
lea rdx, [rbp + 0x170]
mov qword [rbp - 0x38], r14
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x50], 0
mov rsi, qword [rbp - 0x38]
mov rbx, qword [rbp - 0x40]
mov r12, qword [rbp - 0x50]
jmp 0x1400013b8
mov rsi, rbx
or rsi, r14
cmp rsi, r15
jbe 0x140001342
mov rsi, r15
add rax, 0x27
jmp 0x140001363
cmp rsi, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140001383
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019e7
mov rcx, rax
call fcn.140001ca0
test rax, rax
je 0x140001994
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140001395
test rcx, rcx
je 0x140001392
call fcn.140001ca0
mov r12, rax
jmp 0x140001395
xor r12d, r12d
mov r8, rbx
mov qword [rbp - 0x50], r12
lea rdx, [rbp + 0x170]
mov qword [rbp - 0x40], rbx
mov rcx, r12
mov qword [rbp - 0x38], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rbx], 0
mov rax, r15
sub rax, rbx
cmp rax, 0x14
jb 0x1400019e1
cmp rsi, r14
lea rdx, [rbp - 0x50]
lea rax, [rbx + 0x14]
xorps xmm0, xmm0
cmova rdx, r12
lea r13, [rbp - 0x70]
mov qword [rsp + 0x50], rdx
xorps xmm1, xmm1
mov r15, r14
movups xmmword [rbp - 0x70], xmm0
movdqu xmmword [rbp - 0x60], xmm1
cmp rax, r14
jbe 0x140001491
mov r15, rax
movabs rcx, 0x7fffffffffffffff
or r15, r14
cmp r15, rcx
jbe 0x140001423
movabs rax, 0x8000000000000000
mov r15, rcx
add rax, 0x27
jmp 0x14000144a
cmp r15, 0x16
mov ecx, 0x16
cmovb r15, rcx
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x140001472
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019e7
mov rcx, rax
call fcn.140001ca0
test rax, rax
je 0x140001994
mov rdx, qword [rsp + 0x50]
lea r13, [rax + 0x27]
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
lea rax, [rbx + 0x14]
jmp 0x14000148d
test rcx, rcx
je 0x14000148a
call fcn.140001ca0
mov rdx, qword [rsp + 0x50]
mov r13, rax
lea rax, [rbx + 0x14]
jmp 0x14000148d
xor r13d, r13d
mov qword [rbp - 0x70], r13
mov r8, rbx
mov qword [rbp - 0x60], rax
mov rcx, r13
mov qword [rbp - 0x58], r15
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [0x140003460]
cmp rsi, r14
lea r15, [rsp + 0x70]
xorps xmm1, xmm1
movups xmmword [rbx + r13], xmm0
mov eax, dword [0x140003470]
mov dword [rbx + r13 + 0x10], eax
xorps xmm0, xmm0
mov byte [rbx + r13 + 0x14], 0
lea rax, [rbp - 0x50]
cmova rax, r12
lea r13, [rbx + 0xa]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x70], xmm0
movdqu xmmword [rbp - 0x80], xmm1
cmp r13, r14
jbe 0x140001583
mov r14, r13
movabs rcx, 0x7fffffffffffffff
or r14, 0xf
cmp r14, rcx
jbe 0x14000153e
movabs rax, 0x8000000000000000
mov r14, rcx
add rax, 0x27
mov rcx, rax
call fcn.140001ca0
test rax, rax
je 0x140001994
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
mov rax, qword [rsp + 0x50]
jmp 0x14000157e
cmp r14, 0x16
mov ecx, 0x16
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x140001567
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019e7
jmp 0x14000151a
test rcx, rcx
je 0x14000157b
call fcn.140001ca0
mov r15, rax
mov rax, qword [rsp + 0x50]
jmp 0x14000157e
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov r8, rbx
mov qword [rbp - 0x80], r13
mov rdx, rax
mov qword [rbp - 0x78], r14
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.Hooks.dll]
lea rdx, [rbp - 0x70]
movsd qword [rbx + r15], xmm0
lea rcx, str.losslessExe:__s_n
movzx eax, word [0x140003480]
mov word [rbx + r15 + 8], ax
mov byte [r15 + r13], 0
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
call fcn.140001010
cmp qword [rbp - 0x78], 0xf
lea rdx, [rsp + 0x70]
lea rcx, str.hooksDll:__s_n
cmova rdx, qword [rsp + 0x70]
call fcn.140001010
cmp qword [rbp - 0x58], 0xf
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rcx, [rbp - 0x70]
cmova rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
xor r13d, r13d
mov qword [rsp + 0x38], r13
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], r13d
xor edx, edx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140001883
mov rcx, qword [rsp + 0x58]
mov edx, 0xc8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [rbp - 0x78], 0xf
lea rbx, [rsp + 0x70]
cmova rbx, qword [rsp + 0x70]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x40], 0x130
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400016ad
lea rdx, str.LosslessScaling.exe
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, r14
test eax, eax
je 0x140001808
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001683
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r13d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140001835
mov r8, rdi
inc r8
cmp byte [rbx + r8], r13b
jne 0x1400016d5
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x140001817
mov r9, rdi
nop dword [rax]
inc r9
cmp byte [rbx + r9], r13b
jne 0x140001710
inc r9
mov qword [rsp + 0x20], r13
mov r8, rbx
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], r13d
xor edx, edx
mov qword [rsp + 0x20], r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r13, rax
test rax, rax
je 0x1400017e8
mov edx, 0xc8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rbx + rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x140001783
lea r9, [rdi + 1]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x280]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Allocated_space_value:
call fcn.140001a60
mov rcx, rax
lea rdx, [rbp + 0x280]
call fcn.140001a60
mov rcx, rax
lea rdx, [0x1400034e4]
call fcn.140001a60
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000186b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0x48]
jmp 0x1400016b9
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_allocate_memory_in_the_remote_process_n
call fcn.140001a60
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000186b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.OpenProcess_failed_with_error
mov ebx, eax
call fcn.140001a60
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001c30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400018d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.CreateProcess_failed_with_error
mov ebx, eax
call fcn.140001a60
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001c30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
lea r8, str.Fail_
lea rdx, str.Cannot_open_lossless_process_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000190e
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001909
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001994
call fcn.140001cdc
mov rdx, qword [rbp - 0x58]
movdqa xmm0, xmmword [0x1400035b0]
mov byte [rsp + 0x70], 0
movdqu xmmword [rbp - 0x80], xmm0
cmp rdx, 0xf
jbe 0x140001957
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001952
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001994
call fcn.140001cdc
movdqa xmm0, xmmword [0x1400035b0]
mov byte [rbp - 0x70], 0
movdqu xmmword [rbp - 0x60], xmm0
cmp rsi, 0xf
jbe 0x1400019a3
lea rdx, [rsi + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14000199b
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000199b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.140001cdc
mov r14, qword [rsp + 0x4a0]
xor eax, eax
mov r13, qword [rsp + 0x4e0]
mov r12, qword [rsp + 0x4d8]
mov rsi, qword [rsp + 0x4d0]
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.140001c80
add rsp, 0x4a8
pop r15
pop rdi
pop rbx
pop rbp
ret
call fcn.140001210
int3
call fcn.140001170
int3