Function at 0x140076200
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Inject thread
Log keystrokes via polling
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x4c0
mov rax, qword [0x14021f0c0]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
xor edi, edi
lea ecx, [rdi + 8]
call fcn.1400b1b80
lea rcx, [0x140076080]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140076cb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400767ac
lea rdx, str.ArtemisInjector_v1.0.0_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140076830
lea rdx, [0x140076a00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Setting_Up...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140076830
lea rdx, [0x140076a00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea ecx, [rdi + 3]
call fcn.140076dd0
call fcn.140076cf0
mov rbx, rax
test rax, rax
je 0x1400763e8
lea r8, [0x140209474]
lea rdx, str.artemis.dll
lea rcx, [0x140230460]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
cmp qword [0x140230460], rdi
je 0x14007657f
lea r8, str.https:__raw.githubusercontent.com_worldtoscreen_artemis_main_production_solutiondir_injector_artemis.dll
mov edx, 0x2712
mov rcx, rbx
call fcn.140076d50
xor r8d, r8d
lea edx, [rdi + 0x40]
mov rcx, rbx
call fcn.140076d50
xor r8d, r8d
lea edx, [rdi + 0x51]
mov rcx, rbx
call fcn.140076d50
lea r8, [0x140076070]
mov edx, 0x4e2b
mov rcx, rbx
call fcn.140076d50
mov r8, qword [0x140230460]
mov edx, 0x2711
mov rcx, rbx
call fcn.140076d50
mov rcx, rbx
call fcn.140076d40
mov esi, eax
test eax, eax
je 0x1400763d3
lea rdx, str.cURL_error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140076830
mov rbx, rax
mov ecx, esi
call fcn.140077290
mov rdx, rax
mov rcx, rbx
call fcn.140076830
lea rdx, [0x140076a00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Download_failed._Exiting_in_3_seconds.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140076830
lea rdx, [0x140076a00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp dword [rsp + 0x50], 0
je 0x140076785
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov rcx, qword [0x140230460]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rbx
call fcn.140076ce0
call fcn.140076d80
cmp qword [0x140230460], 0
je 0x140076392
mov byte [reloc.WS2_32.dll_accept], 0
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor r9d, r9d
lea r8, str.Setup_completed_
lea rdx, str.Press_F6_after_launching_the_game.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop dword [rax]
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140076420
mov edx, 0x1f4
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Beep]
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x64]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140076536
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140076536
mov qword [rsp + 0x20], 0xff
lea r9, [rsp + 0x8c]
mov r8d, 0xff
lea rdx, [rsp + 0x2a0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rdx, str.Zoo_Single_Win64_Shipping.exe
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1400765a7
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140076536
nop
mov qword [rsp + 0x20], 0xff
lea r9, [rsp + 0x8c]
mov r8d, 0xff
lea rdx, [rsp + 0x2a0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rdx, str.Zoo_Single_Win64_Shipping.exe
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1400765a7
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400764e0
mov ebx, 0xffffffff
xor r9d, r9d
lea r8, [rsp + 0x3a0]
mov edx, 0x104
lea rcx, str.artemis.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x1400765d2
xor r9d, r9d
lea r8, str.Failed_
lea rdx, str.Failed_to_get_DLL_path
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 0xffffffff
jmp 0x1400763c1
lea rdx, str.Failed_to_open_file_for_writing
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140076830
lea rdx, [0x140076a00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400763ed
mov ebx, dword [rsp + 0x68]
mov eax, ebx
test ebx, ebx
jne 0x14007653b
xor r9d, r9d
lea r8, str.Failed_
lea rdx, str.Failed_to_find_Process_ID.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea edi, [rbx - 1]
jmp 0x1400763c1
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14007660b
xor r9d, r9d
lea r8, str.Failed_
lea rdx, str.Failed_to_open_handle._External_AC_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edi, ebx
jmp 0x1400763c1
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
movsxd r8, eax
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x140076660
xor r9d, r9d
lea r8, str.Failed_
lea rdx, str.VirtualAllocEx_Failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea edi, [rsi - 1]
jmp 0x1400763c1
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
movsxd r9, eax
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x3a0]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400766b3
xor r9d, r9d
lea r8, str.Failed_
lea rdx, str.WriteProcessMemory_Failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 0xffffffff
jmp 0x1400763c1
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140076762
lea rdx, [0x1402097f0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140076705
xor r9d, r9d
lea r8, str.Failed_
lea rdx, str.Failed_to_find_LoadLibraryA
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 0xffffffff
jmp 0x1400763c1
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp rax, 0xffffffffffffffff
jne 0x14007674d
xor r9d, r9d
lea r8, str.Failed_
lea rdx, str.Failed_to_crate_remote_thread
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 0xffffffff
jmp 0x1400763c1
mov edx, 0x1f4
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Beep]
jmp 0x1400763c1
xor r9d, r9d
lea r8, str.Failed_
lea rdx, str.Failed_to_find_kernel32
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 0xffffffff
jmp 0x1400763c1
mov eax, edi
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1400b1b60
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov dword [rsp + 0x50], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3