Function at 0x1400365a0
Capabilities:
Create thread
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x14008a6c0]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
xor r14d, r14d
mov r13d, r14d
mov dword [rsp + 0x44], r14d
call fcn.140009870
mov rcx, rax
call fcn.140009930
call fcn.14002f1e0
mov rcx, rax
call fcn.140015e40
lea rbx, [0x14008a308]
mov rcx, rbx
call fcn.140037c70
lea rsi, [0x140056dec]
test al, al
je 0x140036664
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
lea r8d, [r14 + 0xb]
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Loaded_settings.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r14w
mov rdx, qword [0x14008c6f0]
lea r12, [rdx + 0x10]
mov qword [rsp + 0x48], r12
cmp qword [rdx + 0x28], 0xf
jbe 0x14003669e
mov r12, qword [rdx + 0x10]
mov qword [rsp + 0x48], r12
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x50], rax
mov ecx, dword [rdx + 8]
test ecx, ecx
je 0x1400366c9
cmp ecx, 1
jne 0x1400369ce
add rdx, 0x30
lea rcx, [rbp - 0x40]
call fcn.14001e2b0
jmp 0x1400369ce
add rdx, 0x70
lea rcx, [rbp - 0x40]
call fcn.14001e2b0
mov rax, qword [0x14008c6f0]
lea rcx, [rax + 0x50]
cmp qword [rax + 0x68], 0xf
jbe 0x1400366ec
mov rcx, qword [rax + 0x50]
mov rax, qword [rax + 0x60]
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rax
vmovups xmm0, xmmword [rbp - 0x80]
vmovdqa xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.14002f420
nop
cmp byte [rbp + 0x24], 0
jne 0x140036781
lea rbx, [0x14008a330]
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x1400368c3
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x1c
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Host_did_not_return_valid_version_data__does_it_have_a_version.json_
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
jmp 0x1400368c3
lea rcx, [rbp - 0x40]
call fcn.140031e20
mov rcx, qword [0x14008c6f0]
test al, al
je 0x1400367a4
mov eax, dword [rbp + 0x20]
cmp dword [rcx + 0x90], eax
jge 0x140036953
lea rax, [0x14005c5b8]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 5
lea rax, [rcx + 0x50]
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400367c8
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rax
movabs rax, 0xc000000000000000
mov qword [rbp + 0x30], rax
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rax, qword [rbp - 0x20]
mov qword [rbp + 0x50], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0x58], rax
movabs rax, 0xc000000000000010
mov qword [rbp + 0x38], rax
mov qword [rbp - 0x80], 2
lea rax, [rbp + 0x30]
mov qword [rbp - 0x78], rax
vmovups xmm0, xmmword [rbp - 0x80]
vmovdqa xmmword [rbp - 0x80], xmm0
vmovups xmm1, xmmword [rbp - 0x60]
vmovdqa xmmword [rbp - 0x60], xmm1
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x58]
call fcn.14002b470
mov r13d, 0x80
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rax, qword [rsp + 0x58]
mov qword [rbp - 0x80], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x78], rax
vmovups xmm0, xmmword [rbp - 0x80]
vmovdqa xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x80]
call fcn.14002ebb0
movzx edi, al
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400368be
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400368b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400368b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004e814
test dil, dil
jne 0x1400368d7
lea rcx, [rbp - 0x20]
call fcn.140006070
mov r14d, 1
jmp 0x140037b11
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x14003694c
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x2a
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Downloaded_new_DLL_from_remote__new_DLL_version_is
call fcn.140006eb0
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
mov rcx, rax
call fcn.140007150
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
mov rcx, qword [0x14008c6f0]
mov eax, dword [rbp + 0x20]
mov dword [rcx + 0x90], eax
call fcn.14002f1e0
mov rcx, rax
call fcn.140016240
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x1400369c5
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x2f
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Saved_new_version_to_disk.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
nop
lea rcx, [rbp - 0x20]
call fcn.140006070
lea rcx, [rbp - 0x40]
call fcn.140031e20
test al, al
jne 0x140036c10
lea rbx, [0x14008a330]
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x140037a92
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x36
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Unable_to_find_DLL_file_
call fcn.140006eb0
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r12, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova r12, qword [rbp - 0x40]
mov r15, qword [rbp - 0x30]
call fcn.14004de40
mov dword [rsp + 0x48], eax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x60], xmm0
mov rdx, r14
mov qword [rbp - 0x50], rdx
mov edi, recv
mov qword [rbp - 0x48], rdi
mov byte [rbp - 0x60], dl
or r13d, 0x10
mov dword [rsp + 0x44], r13d
test r15, r15
je 0x140036b74
cmp r15, 0x7fffffff
ja 0x140037b91
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, r15d
mov rdx, r12
mov ecx, eax
call fcn.14004deb0
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140037b9c
movsxd rcx, ebx
mov rdx, qword [rbp - 0x50]
cmp rcx, rdx
ja 0x140036ae0
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], rdi
cmova rax, qword [rbp - 0x60]
mov qword [rbp - 0x50], rcx
mov byte [rax + rcx], 0
jmp 0x140036b3c
mov rsi, rcx
sub rsi, rdx
mov rdi, qword [rbp - 0x48]
mov rax, rdi
sub rax, rdx
cmp rsi, rax
ja 0x140036b1d
mov qword [rbp - 0x50], rcx
lea rax, [rbp - 0x60]
cmp rdi, 0xf
cmova rax, qword [rbp - 0x60]
lea rdi, [rax + rdx]
mov r8, rsi
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov byte [rdi + rsi], 0
jmp 0x140036b37
mov byte [rsp + 0x20], 0
mov r9, rsi
movzx r8d, byte [rsp + 0x40]
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.14000e0c0
mov rsi, qword [rsp + 0x50]
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova r9, qword [rbp - 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, r15d
mov rdx, r12
mov ecx, dword [rsp + 0x48]
call fcn.14004deb0
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140037ba8
mov rdi, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
lea rax, [rbp - 0x60]
cmp rdi, 0xf
cmova rax, qword [rbp - 0x60]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
mov word [rbp - 0x70], 0x5c22
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.14001e5a0
mov rdi, rax
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140036bdc
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036bd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036bd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004e814
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], recv
mov byte [rbp - 0x60], 0
lea rdx, str.__make_sure_it_exists.
mov rcx, rdi
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
mov r14d, 1
jmp 0x140037b11
lea rdi, [rbp - 0x40]
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x28]
cmp rsi, 7
cmova rdi, rbx
mov r15, qword [rbp - 0x30]
lea rcx, [r15 + r15]
lea rdx, [rcx + rdi]
sar rcx, 1
cmp rcx, 2
jl 0x140036c67
mov eax, dword [rdi]
and eax, 0xffffffdf
sub eax, 0x3a0041
cmp eax, 0x1a
jae 0x140036c67
cmp rcx, 3
jl 0x140036c78
movzx eax, word [rdi + 4]
cmp ax, 0x5c
je 0x140036e4a
cmp ax, 0x2f
jne 0x140036c78
jmp 0x140036e4a
mov rcx, rdi
call fcn.14002fcb0
cmp rdi, rax
jne 0x140036e4a
mov dword [rbp - 0x80], r14d
lea rax, [0x14008a010]
mov qword [rbp - 0x78], rax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
or r13d, 0x40
mov dword [rsp + 0x44], r13d
mov eax, r14d
test r15, r15
je 0x140036dc7
mov word [rsp + 0x20], r14w
mov r9d, 0x104
movzx r8d, byte [rsp + 0x40]
mov edx, r9d
lea rcx, [rsp + 0x58]
call fcn.140005150
movzx esi, byte [rsp + 0x40]
nop
mov r15d, dword [rsp + 0x68]
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova r8, qword [rsp + 0x58]
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rcx, qword [rbp - 0x40]
mov edx, r15d
call fcn.14004e0a0
mov rbx, rax
mov qword [rbp - 0x60], rax
mov ecx, eax
mov r8, qword [rsp + 0x68]
cmp rcx, r8
ja 0x140036d3c
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rcx
mov word [rax + rcx*2], r14w
jmp 0x140036d9b
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rsp + 0x70]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140036d84
mov qword [rsp + 0x68], rcx
lea r9, [rsp + 0x58]
cmp rdi, 7
cmova r9, qword [rsp + 0x58]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140036d79
movzx eax, r14w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r14w
jmp 0x140036d9b
mov word [rsp + 0x20], r14w
mov r9, rdx
movzx r8d, sil
lea rcx, [rsp + 0x58]
call fcn.140005150
cmp ebx, r15d
jae 0x140036ce0
mov eax, dword [rbp - 0x5c]
mov dword [rbp - 0x80], eax
lea rcx, [0x14008a010]
mov qword [rbp - 0x78], rcx
vmovups xmm0, xmmword [rbp - 0x80]
vmovdqa xmmword [rbp - 0x80], xmm0
mov rsi, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x40]
and r13d, 0xffffffbf
or r13d, 0x20
mov dword [rsp + 0x44], r13d
test eax, eax
jne 0x140037bb2
cmp rsi, 7
jbe 0x140036e1a
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140036e12
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036e12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14004e814
vmovups ymm0, ymmword [rsp + 0x58]
vmovups ymmword [rbp - 0x40], ymm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
and r13d, 0xffffffdf
lea rcx, [rsp + 0x58]
vzeroupper
call fcn.140006360
lea rdi, [0x14008a308]
mov rcx, rdi
call fcn.140037c70
lea r15, [0x140056dec]
test al, al
je 0x140036fd3
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
lea r9, str.main
mov r8d, 0x3d
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Starting_injection_for
call fcn.140006eb0
mov rsi, rax
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x30]
lea rbx, [rcx + rax*2]
mov rdi, rbx
mov rdx, rbx
call fcn.14002fcb0
cmp rax, rbx
je 0x140036f0e
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x140036ee5
cmp cx, 0x2f
jne 0x140036eee
add rax, 2
cmp rax, rbx
jne 0x140036ed6
cmp rax, rbx
je 0x140036f0e
lea rdx, [rdi - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x140036f0e
cmp cx, 0x2f
je 0x140036f0e
mov rdi, rdx
cmp rax, rdx
jne 0x140036ef3
mov qword [rbp - 0x80], rdi
sub rbx, rdi
sar rbx, 1
mov qword [rbp - 0x78], rbx
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.14001ebd0
or r13d, 1
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x60]
call fcn.14002b210
or r13d, 2
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
mov rcx, rsi
call fcn.140007150
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140036fa6
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036fa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036fa1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004e814
vmovdqu xmm0, xmmword [0x140056ff0]
vmovdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
lea rcx, [rbp - 0x60]
call fcn.140006360
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
lea rdi, [0x14008a308]
lea rcx, [rbp - 0x40]
call fcn.14002e620
cmp eax, 5
ja case.default.0x140036ff8
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x37c00]
add rcx, rdx
jmp rcx
lea rbx, [0x14008a330]
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x140037a92
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x42
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Failed_to_access_DLL_on_disk.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
mov r14d, 1
jmp 0x140037b11
lea rbx, [0x14008a330]
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x140037a92
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x46
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.DLL_file_seems_inconceivably_small__request_to_inject_ignored.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
mov r14d, 1
jmp 0x140037b11
lea rbx, [0x14008a330]
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x140037a92
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x4a
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Failed_to_allocate_memory_when_checking_DLL_file.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
mov r14d, 1
jmp 0x140037b11
lea rbx, [0x14008a330]
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x140037a92
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x4e
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.The_file_given_does_not_appear_to_be_a_valid_DLL.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
mov r14d, 1
jmp 0x140037b11
lea rbx, [0x14008a330]
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x140037a92
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x52
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.The_DLL_given_did_not_match_the_target_platform_the_injector.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
mov r14d, 1
jmp 0x140037b11
mov rcx, rdi
call fcn.140037c70
test al, al
je case.default.0x140036ff8
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
lea r9, str.main
mov r8d, 0x56
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.DLL_seems_valid__proceeding_with_injection.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
mov rsi, 0xffffffffffffffff
mov rdi, rsi
inc rdi
cmp byte [r12 + rdi], 0
jne 0x140037294
inc rdi
mov eax, 2
mul rdi
cmovo rax, rsi
mov rcx, rax
call fcn.14004ec60
mov r12, rax
mov r8, rdi
mov rdi, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x1a4]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1a0], 0x238
lea rbx, [0x14008a330]
cmp r15, rsi
jne 0x14003736e
mov rcx, rbx
call fcn.140037c70
lea rsi, [0x140056dec]
test al, al
je 0x1400373f8
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.Injector::GetProcessId
mov r8d, 0x24
lea rdx, str.C:UsersPCCDesktopInjector_master_srcInjector.hpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.CreateToolhelp32Snapshot_returned_INVALID_HANDLE_VALUE__unable_to_proceed.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
jmp 0x1400373f8
mov edi, esi
lea rdx, [rbp + 0x1a0]
mov rcx, r15
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400373db
nop dword [rax]
nop word [rax + rax]
lea rax, [rbp + 0x1cc]
mov rdi, r12
sub rdi, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x1400373b3
add rax, 2
test ecx, ecx
jne 0x1400373a0
test edx, edx
je 0x1400373d5
lea rdx, [rbp + 0x1a0]
mov rcx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140037390
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400373ec
mov edi, dword [rbp + 0x1a8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, esi
jne 0x140037481
lea rsi, [0x140056dec]
mov rdi, qword [rsp + 0x48]
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x140037a92
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x5e
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Unable_to_find_target_application
call fcn.140006eb0
mov r8, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, rax
call fcn.140007150
mov rcx, rax
lea rdx, str.__is_it_running_
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
mov r14d, 1
jmp 0x140037b11
lea r12, [0x14008a308]
mov rcx, r12
call fcn.140037c70
lea r15, [0x140056dec]
test al, al
je 0x140037516
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
lea r9, str.main
mov r8d, 0x62
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Found_target_application
call fcn.140006eb0
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140007150
lea rdx, str._with_process_id_
mov rcx, rax
call fcn.140006eb0
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x14003759c
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x140037a92
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r9, str.main
lea r8d, [r12 + 0x68]
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Failed_to_open_target_with_necessary_rights_to_inject.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
lea r14d, [r12 + 2]
jmp 0x140037b11
mov rax, qword [0x14008c6f0]
cmp dword [rax + 0xc], 0
jne 0x140037a9a
lea rdi, [0x14008a308]
mov rcx, rdi
call fcn.140037c70
test al, al
je 0x14003760f
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
lea r9, str.main
mov r8d, reloc.WS2_32.dll_WSAGetLastError
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Attempting_LoadLibrary_of_DLL...
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
lea r15, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova r15, qword [rbp - 0x40]
mov qword [rbp - 0x80], r15
mov rdi, qword [rbp - 0x30]
mov qword [rbp - 0x60], rdi
call fcn.14004de40
mov dword [rsp + 0x48], eax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov ecx, recv
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x58], 0
bts r13d, 0xb
mov dword [rsp + 0x44], r13d
test rdi, rdi
je 0x14003775c
cmp rdi, 0x7fffffff
ja 0x140037bc7
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, edi
mov rdx, r15
mov ecx, eax
call fcn.14004deb0
mov r15, rax
shr rax, 0x20
test eax, eax
jne 0x140037bd2
movsxd rcx, r15d
mov rdx, qword [rsp + 0x68]
cmp rcx, rdx
ja 0x1400376bd
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rcx
mov byte [rax + rcx], 0
jmp 0x140037722
mov r12, rcx
sub r12, rdx
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rdx
cmp r12, rax
ja 0x140037702
mov qword [rsp + 0x68], rcx
lea rdi, [rsp + 0x58]
cmp r8, 0xf
cmova rdi, qword [rsp + 0x58]
add rdi, rdx
mov r8, r12
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov byte [r12 + rdi], 0
mov rdi, qword [rbp - 0x60]
jmp 0x14003771d
mov byte [rsp + 0x20], 0
mov r9, r12
movzx r8d, byte [rsp + 0x40]
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.14000e0c0
mov r12, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova r9, qword [rsp + 0x58]
mov dword [rsp + 0x20], r15d
mov r8d, edi
mov rdx, qword [rbp - 0x80]
mov ecx, dword [rsp + 0x48]
call fcn.14004deb0
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140037bdf
mov rcx, qword [rsp + 0x70]
btr r13d, 0xb
or r13d, 0x700
lea rax, [rsp + 0x58]
cmp rcx, 0xf
cmova rax, qword [rsp + 0x58]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140037780
inc r8
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
xor edx, edx
mov r9d, 0x1000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rbp - 0x60], rax
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400377ed
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400377e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400377e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004e814
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], recv
mov byte [rsp + 0x58], 0
test rdi, rdi
jne 0x140037872
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x140037a92
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
lea rsi, [0x140056dec]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
lea r8d, [rdi + 0x74]
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Failed_to_allocate_DLL_file_path_to_target_process.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
lea r14d, [rdi + 1]
jmp 0x140037b11
lea r12, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova r12, qword [rbp - 0x40]
mov r15, qword [rbp - 0x30]
call fcn.14004de40
mov dword [rsp + 0x48], eax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x80], xmm0
vmovdqu xmm1, xmmword [0x140056ff0]
vmovdqu xmmword [rbp - 0x70], xmm1
mov byte [rbp - 0x80], 0
bts r13d, 0xf
mov dword [rsp + 0x44], r13d
test r15, r15
je 0x14003792a
cmp r15, 0x7fffffff
ja 0x140037be9
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, r15d
mov rdx, r12
mov ecx, eax
call fcn.14004deb0
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140037bf4
movsxd rdx, edi
xor r8d, r8d
lea rcx, [rbp - 0x80]
call fcn.14001be60
lea r9, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r9, qword [rbp - 0x80]
mov dword [rsp + 0x20], edi
mov r8d, r15d
mov rdx, r12
mov ecx, dword [rsp + 0x48]
call fcn.14004deb0
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140037b87
mov rdi, qword [rbp - 0x60]
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
nop dword [rax + rax]
lea rsi, [rsi + 1]
cmp byte [r8 + rsi], 0
jne 0x140037940
lea r9, [rsi + 1]
mov qword [rsp + 0x20], r14
mov rdx, rdi
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
lea rcx, [rbp - 0x80]
call fcn.140005e60
test edi, edi
jne 0x1400379e1
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x140037a92
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
lea rsi, [0x140056dec]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
lea r8d, [rdi + 0x7b]
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Failed_to_write_DLL_file_path_to_target_process.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
lea r14d, [rdi + 1]
jmp 0x140037b11
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140037a9a
lea rdx, str.LoadLibraryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov rcx, qword [rbp - 0x60]
mov qword [rsp + 0x20], rcx
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x140037a9a
mov rcx, rbx
call fcn.140037c70
test al, al
je 0x140037a92
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
lea rsi, [0x140056dec]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x82
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Failed_to_start_LoadLibrary_call_with_remote_thread.
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
mov r14d, 1
jmp 0x140037b11
lea rdi, [0x14008a308]
mov rcx, rdi
call fcn.140037c70
test al, al
je 0x140037b03
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], socket
lea rsi, [0x140056dec]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
lea r9, str.main
mov r8d, 0x88
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp + 0x60]
call fcn.1400447e0
nop
lea rcx, [rax + 8]
lea rdx, str.Successfully_sent_instructions_to_target_process_
call fcn.140006eb0
nop
lea rcx, [rbp + 0x60]
call fcn.1400449b0
call fcn.140009870
mov rcx, rax
call fcn.140008dc0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140037b54
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037b4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037b4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004e814
mov eax, r14d
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.14004eb70
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rcx, 0x20
call fcn.140006280
nop
mov ecx, socket
call fcn.140006240
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140006280
int3
shr rcx, 0x20
call fcn.140006280
nop
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x80]
lea rcx, str.absolute
call fcn.140030450
nop
mov ecx, socket
call fcn.140006240
int3
shr r15, 0x20
mov ecx, r15d
call fcn.140006280
int3
shr rcx, 0x20
call fcn.140006280
nop
mov ecx, socket
call fcn.140006240
int3
shr rdi, 0x20
mov ecx, edi
call fcn.140006280
int3