Function at 0x140001000
Capabilities:
Create thread
Enumerate processes
Inject dll
Inject thread

Disassembly:
push rbx
sub rsp, 0x190
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000104f
lea r9d, [rax + 0x11]
xor ecx, ecx
lea r8, str.SRUIC_Injector:_Fatal_Error
lea rdx, str.Failed_to_create_process_snapshot
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, ebx
jmp 0x1400012d9
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rbx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x140001097
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x10
lea r8, str.SRUIC_Injector:_Fatal_Error
lea rdx, str.Failed_to_handle_first_process_in_snapshot
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0xffffffff
jmp 0x1400012d9
mov qword [rsp + 0x1a0], rbp
xor ebp, ebp
mov qword [rsp + 0x1b0], rdi
mov edi, ebp
nop dword [rax + rax]
lea rdx, str.SnowRunner.exe
lea rcx, [rsp + 0x7c]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x1400010d9
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400010b0
jmp 0x1400010dd
mov edi, dword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000110c
lea r9d, [rdi + 0x10]
xor ecx, ecx
lea r8, str.SRUIC_Injector:_Fatal_Error
lea rdx, str.Failed_to_locate_SnowRunner_process._Is_the_game_running_
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [rdi - 1]
jmp 0x1400012c9
xor edx, edx
mov r8d, edi
lea ecx, [rdx + 0x2a]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140001144
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.SRUIC_Injector:_Fatal_Error
lea rdx, str.Failed_to_open_SnowRunner_process
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [rbx - 1]
jmp 0x1400012c9
lea rcx, str.SRUIC.dll
mov qword [rsp + 0x1a8], rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 0x1000
mov dword [rsp + 0x20], 4
inc eax
xor edx, edx
movsxd rdi, eax
mov rcx, rbx
add rdi, rdi
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x1400011a7
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.SRUIC_Injector:_Fatal_Error
lea rdx, str.Memory_allocation_failed
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [rsi - 1]
jmp 0x1400012c1
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, str.SRUIC.dll
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400011ea
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.SRUIC_Injector:_Fatal_Error
lea rdx, str.Memory_write_failed
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0xffffffff
jmp 0x1400012c1
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001230
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.SRUIC_Injector:_Fatal_Error
lea rdx, str.Couldnt_find_LoadLibraryW
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0xffffffff
jmp 0x1400012c1
mov qword [rsp + 0x30], rbp
mov r9, rax
mov dword [rsp + 0x28], ebp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
jne 0x140001276
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.SRUIC_Injector:_Fatal_Error
lea rdx, str.Failed_to_create_remote_thread
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [rbx - 1]
jmp 0x1400012c1
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x40], ebp
jne 0x1400012bf
mov r9d, 0x10
lea r8, str.SRUIC_Injector:_Fatal_Error
lea rdx, str.Failed_to_inject_DLL._Is_SRUIC.dll_in_the_same_folder_as_SnowRunner.exe_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0xffffffff
jmp 0x1400012c1
xor eax, eax
mov rsi, qword [rsp + 0x1a8]
mov rbp, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140001390
add rsp, 0x190
pop rbx
ret