Function at 0x140011316
Capabilities:
Create thread
Execute command
Inject dll
Inject thread

Disassembly:
jmp 0x140012460
push rbp
push rsi
push rdi
sub rsp, 0x830
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x16c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x7e8], rax
lea rcx, [0x1400250f4]
call fcn.140011438
mov dword [rbp + 0x264], 0
mov qword [rbp + 0x288], 0
lea rax, str.notepad.exe
mov qword [rbp + 0x2a8], rax
xor edx, edx
mov ecx, 2
call fcn.140011212
mov qword [rbp + 0x288], rax
cmp qword [rbp + 0x288], 0
jne 0x140012518
lea rcx, str.Color_0a
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str.FAIL:_COULDNt_Make_SNAPSHOT
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140012932
mov dword [rbp + 0x10], 0x238
mov rdx, qword [rbp + 0x2a8]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140012562
lea rdx, str.FOUND_THE_PROCESS
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, dword [rbp + 0x18]
mov dword [rbp + 0x264], eax
jmp 0x140012576
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x288]
call fcn.1400113e8
test eax, eax
jne 0x14001251f
lea rdx, str.PID:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
mov edx, dword [rbp + 0x264]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp + 0x2c8], 0
mov qword [rbp + 0x308], 0
mov qword [rbp + 0x328], 0
lea rax, [rbp + 0x350]
lea rcx, str.C:UsersZavie_source_reposTESTINGCTESTINGCmyfirstrealDLL.dll
mov rdi, rax
mov rsi, rcx
mov ecx, 0x82
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x3d2]
mov rdi, rax
xor eax, eax
mov ecx, 0x186
rep stosb byte [rdi], al
mov qword [rbp + 0x578], 0x208
mov r8d, dword [rbp + 0x264]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x2e8], rax
cmp qword [rbp + 0x2e8], 0
jne 0x140012664
lea rcx, str.Color_04
call qword [sym.imp.ucrtbased.dll_system]
mov edx, dword [rbp + 0x264]
lea rcx, str.ERROR:_The_Process_has_failed_to_open_with_PID:__ld
call fcn.140011208
lea rdx, [0x14001103c]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140012932
mov edx, dword [rbp + 0x264]
lea rcx, str.SUCCESS:_The_Process_has_been_opened_with_PID:__ld
call fcn.140011208
lea rdx, [0x14001103c]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp + 0x578]
xor edx, edx
mov rcx, qword [rbp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0
jne 0x1400126f6
lea rcx, str.Color_04
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.ERROR:_The_Memory_has_failed_to_be_created
call fcn.140011208
lea rdx, [0x14001103c]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140012932
mov rdx, qword [rbp + 0x2c8]
lea rcx, str.SUCCESS:_The_Memory_space_within_the_process_has_been_created_at_0x_p
call fcn.140011208
lea rdx, [0x14001103c]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x578]
lea r8, [rbp + 0x350]
mov rdx, qword [rbp + 0x2c8]
mov rcx, qword [rbp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.SUCCESS:_The_Memory_space_has_been_written_to_within_the_Process
call fcn.140011208
lea rdx, [0x14001103c]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [rbp + 0x2c8]
lea rcx, str.The_Memory_space_is_at_0x_p
call fcn.140011208
lea rdx, [0x14001103c]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x328], rax
cmp qword [rbp + 0x328], 0
jne 0x1400127e4
lea rcx, str.Color_04
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.ERROR:_The_Kernel32_Module_was_not_found
call fcn.140011208
lea rdx, [0x14001103c]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140012932
lea rcx, str.SUCCESS:_Created_an_instance_of_Kernel32
call fcn.140011208
lea rdx, [0x14001103c]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.We_create_an_instance_of_this_module_so_we_can_end_up_calling_LoadLibraryW_within_that_instance
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
lea rdx, [0x14001103c]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.LoadLibraryW
mov rcx, qword [rbp + 0x328]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x598], rax
mov rdx, qword [rbp + 0x598]
lea rcx, str.The_memory_address_inside_of_the_instance_of_Kernel32_where__LoadLibraryW__is__0x_p
call fcn.140011208
lea rdx, [0x14001103c]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x2c8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x598]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0
jne 0x1400128d4
lea rcx, str.Color_04
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.ERROR:_The_Thread_was_not_able_to_be_created_within_the_process__n
call fcn.140011208
mov eax, 1
jmp 0x140012932
lea rcx, str.SUCCESS:_at_this_point__the_process_has_been_injected_into_already_since_the_DLL_runs_when_a_thread_is_attached_to_it_instantly__setup_that_way__n
call fcn.140011208
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.SUCCESS:_The_Process_has_been_injected_into
call fcn.140011208
lea rdx, [0x14001103c]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140012932
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001bcc0]
call fcn.1400113c5
mov rax, rdi
mov rcx, qword [rbp + 0x7e8]
xor rcx, rbp
call fcn.140011226
lea rsp, [rbp + 0x7f0]
pop rdi
pop rsi
pop rbp
ret