Function at 0x140001450
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x240], ecx
mov qword [rbp + 0x248], rdx
call sym.__main
mov dword [rbp + 0x1e4], 0
mov dword [rbp + 0x214], 0
mov qword [rbp + 0x208], 0
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x218], 0
mov qword [rbp + 0x1f8], 0
movabs rax, 0x55005c003a0043
mov qword [rbp - 0x30], rax
movabs rax, 0x73007200650073
mov qword [rbp - 0x28], rax
movabs rax, 0x7200610063005c
mov qword [rbp - 0x20], rax
movabs rax, 0x73005c006f006c
mov qword [rbp - 0x18], rax
movabs rax, 0x6300720075006f
mov qword [rbp - 0x10], rax
movabs rax, 0x650072005c0065
mov qword [rbp - 8], rax
movabs rax, 0x5c0073006f0070
mov qword [rbp], rax
movabs rax, 0x72006100630049
mov qword [rbp + 8], rax
movabs rdi, 0x76005f00730075
mov qword [rbp + 0x10], rdi
movabs rdx, 0x360078005c0032
mov qword [rbp + 0x18], rdx
movabs rdx, 0x650044005c0034
mov qword [rbp + 0x20], rdx
movabs rdx, 0x5c006700750062
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdi
movabs rax, 0x6c0064002e0032
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 0x6c
lea rdx, [rbp + 0x50]
mov eax, 0
mov ecx, 0x31
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rbp + 0x1f0], 0x208
mov qword [rbp - 0x38], 0
cmp dword [rbp + 0x240], 1
jg 0x1400015cf
mov rax, qword [rbp + 0x248]
mov rax, qword [rax]
mov rdx, rax
lea rax, str.____usage:__s__PID__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140001985
mov rax, qword [rbp + 0x248]
add rax, 8
mov rax, qword [rax]
mov rcx, rax
call sym.atoi
mov dword [rbp + 0x214], eax
mov eax, dword [rbp + 0x214]
mov edx, eax
lea rax, str._i__trying_to_get_a_handle_to_the_process___ld__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, dword [rbp + 0x214]
mov r8d, eax
mov edx, 0
mov ecx, 0x28
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x200], rax
cmp qword [rbp + 0x200], 0
jne 0x14000165e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov eax, dword [rbp + 0x214]
mov r8d, edx
mov edx, eax
lea rax, str.____unable_to_get_a_handle_to_the_process___ld___error:_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140001985
lea rax, str.___got_a_handle_to_the_process__n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x200]
mov rdx, rax
lea rax, str._i_______hProcess_n_t_0x_p__n_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str._i__getting_handle_to_Kernel32.dll_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.kernel32
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov qword [rbp + 0x1f8], rax
cmp qword [rbp + 0x1f8], 0
jne 0x1400016dd
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____failed_to_get_a_handle_to_Kernel32.dll__error:_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140001985
lea rax, str.___got_a_handle_to_Kernel32.dll_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x1f8]
mov rdx, rax
lea rax, str._i_______hKernel32_n_t_0x_p__n_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str._i__getting_address_of_LoadLibraryW___n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x1f8]
lea rdx, str.LoadLibraryW
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x1e8], rax
lea rax, str.___got_address_of_LoadLibraryW___n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x1e8]
mov rdx, rax
lea rax, str._i_______LoadLibraryW_n_t_0x_p__n_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str._i__allocating_memory_in_target_process_n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [rbp + 0x1f0]
mov rax, qword [rbp + 0x200]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x208], rax
cmp qword [rbp + 0x208], 0
jne 0x1400017cc
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____couldnt_allocate_a_buffer_to_the_target_process_memory__error:_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x140001919
lea rax, str.___allocated_buffer_in_target_process_memory__PAGE_READWRITE__n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str._i__writing_to_allocated_buffer_n
mov rcx, rax
call sym.printf_char_const__::_
mov r9, qword [rbp + 0x1f0]
lea r8, [rbp - 0x30]
mov rdx, qword [rbp + 0x208]
mov rax, qword [rbp + 0x200]
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rax, qword [rbp - 0x38]
mov rdx, rax
lea rax, str.___wrote__zu_bytes_to_the_process_memory_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str._i__creating_a_thread_n
mov rcx, rax
call sym.printf_char_const__::_
mov rcx, qword [rbp + 0x1e8]
mov rax, qword [rbp + 0x200]
lea rdx, [rbp + 0x1e4]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0
mov rdx, qword [rbp + 0x208]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x218], rax
cmp qword [rbp + 0x218], 0
jne 0x1400018b2
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____unable_to_create_thread__error:_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x140001919
mov eax, dword [rbp + 0x1e4]
mov edx, eax
lea rax, str.___created_a_new_thread_in_the_target_process____ld__n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x218]
mov rdx, rax
lea rax, str._i_______hThread_n_t_0x_p__n_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str._i__waiting_for_thread_to_finish_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x218]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
lea rax, str.___thread_finished_execution_n
mov rcx, rax
call sym.printf_char_const__::_
nop
cmp qword [rbp + 0x218], 0
je 0x140001945
lea rax, str._i__closing_handle_to_thread_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x218]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp qword [rbp + 0x200], 0
je 0x140001971
lea rax, str._i__closing_handle_to_process_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, str.___finished_with_house_keeping__see_you_next_time__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
add rsp, 0x2a8
pop rdi
pop rbp
ret