Function at 0x140001230
Capabilities:
Create process on windows
Create thread
Enumerate processes
Get common file path
Inject dll
Inject thread

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x3a8]
sub rsp, 0x4a8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x390], rax
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x140003460]
lea rdx, str.conout_
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x140003460]
lea rdx, str.conout_
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
xorps xmm0, xmm0
mov dword [rbp - 0x30], 0x68
xor eax, eax
lea rdx, [rbp + 0x170]
mov ecx, 0x104
mov dword [rbp + 0x34], eax
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xorps xmm0, xmm0
lea rax, [rbp + 0x170]
mov rdi, 0xffffffffffffffff
movups xmmword [rbp - 0x50], xmm0
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001300
mov qword [rsp + 0x4d0], rsi
movabs r15, 0x7fffffffffffffff
mov qword [rsp + 0x4d8], r12
mov qword [rsp + 0x4e0], r13
mov qword [rsp + 0x4a0], r14
cmp rbx, r15
ja 0x140001a3c
mov r14d, 0xf
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp rbx, r14
ja 0x140001387
mov r8, rbx
mov qword [rbp - 0x40], rbx
lea rdx, [rbp + 0x170]
mov qword [rbp - 0x38], r14
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x50], 0
mov rsi, qword [rbp - 0x38]
mov rbx, qword [rbp - 0x40]
mov r12, qword [rbp - 0x50]
jmp 0x140001411
mov rsi, rbx
or rsi, r14
cmp rsi, r15
jbe 0x14000139b
mov rsi, r15
add rax, 0x27
jmp 0x1400013bc
cmp rsi, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400013dc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001a42
mov rcx, rax
call fcn.140001cc0
test rax, rax
je 0x1400019ef
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x1400013ee
test rcx, rcx
je 0x1400013eb
call fcn.140001cc0
mov r12, rax
jmp 0x1400013ee
xor r12d, r12d
mov r8, rbx
mov qword [rbp - 0x50], r12
lea rdx, [rbp + 0x170]
mov qword [rbp - 0x40], rbx
mov rcx, r12
mov qword [rbp - 0x38], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rbx], 0
mov rax, r15
sub rax, rbx
cmp rax, 0x14
jb 0x140001a3c
cmp rsi, r14
lea rdx, [rbp - 0x50]
lea rax, [rbx + 0x14]
xorps xmm0, xmm0
cmova rdx, r12
lea r13, [rbp - 0x70]
mov qword [rsp + 0x50], rdx
xorps xmm1, xmm1
mov r15, r14
movups xmmword [rbp - 0x70], xmm0
movdqu xmmword [rbp - 0x60], xmm1
cmp rax, r14
jbe 0x1400014ea
mov r15, rax
movabs rcx, 0x7fffffffffffffff
or r15, r14
cmp r15, rcx
jbe 0x14000147c
movabs rax, 0x8000000000000000
mov r15, rcx
add rax, 0x27
jmp 0x1400014a3
cmp r15, 0x16
mov ecx, 0x16
cmovb r15, rcx
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x1400014cb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001a42
mov rcx, rax
call fcn.140001cc0
test rax, rax
je 0x1400019ef
mov rdx, qword [rsp + 0x50]
lea r13, [rax + 0x27]
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
lea rax, [rbx + 0x14]
jmp 0x1400014e6
test rcx, rcx
je 0x1400014e3
call fcn.140001cc0
mov rdx, qword [rsp + 0x50]
mov r13, rax
lea rax, [rbx + 0x14]
jmp 0x1400014e6
xor r13d, r13d
mov qword [rbp - 0x70], r13
mov r8, rbx
mov qword [rbp - 0x60], rax
mov rcx, r13
mov qword [rbp - 0x58], r15
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [0x140003470]
cmp rsi, r14
lea r15, [rsp + 0x70]
xorps xmm1, xmm1
movups xmmword [rbx + r13], xmm0
mov eax, dword [0x140003480]
mov dword [rbx + r13 + 0x10], eax
xorps xmm0, xmm0
mov byte [rbx + r13 + 0x14], 0
lea rax, [rbp - 0x50]
cmova rax, r12
lea r13, [rbx + 0xa]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x70], xmm0
movdqu xmmword [rbp - 0x80], xmm1
cmp r13, r14
jbe 0x1400015dc
mov r14, r13
movabs rcx, 0x7fffffffffffffff
or r14, 0xf
cmp r14, rcx
jbe 0x140001597
movabs rax, 0x8000000000000000
mov r14, rcx
add rax, 0x27
mov rcx, rax
call fcn.140001cc0
test rax, rax
je 0x1400019ef
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
mov rax, qword [rsp + 0x50]
jmp 0x1400015d7
cmp r14, 0x16
mov ecx, 0x16
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1400015c0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001a42
jmp 0x140001573
test rcx, rcx
je 0x1400015d4
call fcn.140001cc0
mov r15, rax
mov rax, qword [rsp + 0x50]
jmp 0x1400015d7
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov r8, rbx
mov qword [rbp - 0x80], r13
mov rdx, rax
mov qword [rbp - 0x78], r14
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.Hooks.dll]
lea rdx, [rbp - 0x70]
movsd qword [rbx + r15], xmm0
lea rcx, str.losslessExe:__s_n
movzx eax, word [0x140003490]
mov word [rbx + r15 + 8], ax
mov byte [r15 + r13], 0
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
call fcn.140001010
cmp qword [rbp - 0x78], 0xf
lea rdx, [rsp + 0x70]
lea rcx, str.hooksDll:__s_n
cmova rdx, qword [rsp + 0x70]
call fcn.140001010
cmp qword [rbp - 0x58], 0xf
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rcx, [rbp - 0x70]
cmova rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
xor r13d, r13d
mov qword [rsp + 0x38], r13
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], r13d
xor edx, edx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400018df
mov rcx, qword [rsp + 0x58]
mov edx, 0xc8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [rbp - 0x78], 0xf
lea rbx, [rsp + 0x70]
cmova rbx, qword [rsp + 0x70]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x40], 0x130
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000170a
nop dword [rax]
lea rdx, str.LosslessScaling.exe
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, r14
test eax, eax
je 0x140001865
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400016e0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r13d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140001892
mov r8, rdi
inc r8
cmp byte [rbx + r8], r13b
jne 0x140001732
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x140001874
mov r9, rdi
inc r9
cmp byte [rbx + r9], r13b
jne 0x140001766
inc r9
mov qword [rsp + 0x20], r13
mov r8, rbx
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], r13d
xor edx, edx
mov qword [rsp + 0x20], r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r13, rax
test rax, rax
je 0x140001845
mov edx, 0xc8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax]
cmp byte [rbx + rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x1400017e0
lea r9, [rdi + 1]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x280]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Allocated_space_value:
call fcn.140001ac0
mov rcx, rax
lea rdx, [rbp + 0x280]
call fcn.140001ac0
mov rcx, rax
lea rdx, [0x1400034f4]
call fcn.140001ac0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400018c7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0x48]
jmp 0x140001716
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_allocate_memory_in_the_remote_process_n
call fcn.140001ac0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400018c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.OpenProcess_failed_with_error
mov ebx, eax
call fcn.140001ac0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400034f4]
call fcn.140001ac0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000192d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.CreateProcess_failed_with_error
mov ebx, eax
call fcn.140001ac0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400034f4]
call fcn.140001ac0
xor r9d, r9d
lea r8, str.Fail_
lea rdx, str.Cannot_open_lossless_process_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140001969
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001964
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019ef
call fcn.140001cfc
mov rdx, qword [rbp - 0x58]
movdqa xmm0, xmmword [0x1400035c0]
mov byte [rsp + 0x70], 0
movdqu xmmword [rbp - 0x80], xmm0
cmp rdx, 0xf
jbe 0x1400019b2
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019ad
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019ef
call fcn.140001cfc
movdqa xmm0, xmmword [0x1400035c0]
mov byte [rbp - 0x70], 0
movdqu xmmword [rbp - 0x60], xmm0
cmp rsi, 0xf
jbe 0x1400019fe
lea rdx, [rsi + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x1400019f6
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.140001cfc
mov r14, qword [rsp + 0x4a0]
xor eax, eax
mov r13, qword [rsp + 0x4e0]
mov r12, qword [rsp + 0x4d8]
mov rsi, qword [rsp + 0x4d0]
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.140001ca0
add rsp, 0x4a8
pop r15
pop rdi
pop rbx
pop rbp
ret
call fcn.140001210
int3
call fcn.140001170
int3