Function at 0x1400012c0
Capabilities:
Create thread
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14019b040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov r14, rcx
xor r12d, r12d
mov r15, qword [rdx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xa
jb 0x140001531
cmp qword [rdx + 0x18], 0xf
jbe 0x140001316
mov rsi, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rbp, [r15 + 0xa]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp rbp, rbx
jbe 0x1400013b6
mov rbx, rbp
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001377
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140163f80
test rax, rax
je 0x140001447
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400013b1
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000139f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001537
jmp 0x140001358
test rcx, rcx
je 0x1400013ae
call fcn.140163f80
mov rdi, rax
jmp 0x1400013b1
mov rdi, r12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbx
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.d3d10.dll]
movsd qword [rdi + r15], xmm0
movzx eax, word [0x140166750]
mov word [rdi + r15 + 8], ax
mov byte [rdi + rbp], r12b
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rdx, qword [rsp + 0x30]
cmp qword [r14 + 0x18], 0xf
jbe 0x140001408
mov r14, qword [r14]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001453
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000144e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000144e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140163fc4
test ebx, ebx
jne 0x140001497
lea r9d, [rbx + 0x10]
lea r8, str.Error
lea rdx, str.Inject_Failed.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140163e40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x50]
call fcn.1400011a0
mov rcx, qword [rax]
mov qword [0x14019ba20], rcx
mov ecx, 1
call fcn.140163f80
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1400031e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140001520
cmp dword [rsp + 0x38], 0
je 0x140001514
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140001514
mov byte [0x14019ba1a], 1
jmp 0x140001471
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140001280
int3
call fcn.140001100
int3