Function at 0x140001160
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r15, rdx
mov r14, rcx
xor r12d, r12d
test rcx, rcx
je 0x14000155e
test rdx, rdx
je 0x14000155e
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
lea rcx, str.C:UsersUtilizadorDownloadsReleaseBlankDllTotest.dll
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400011f8
lea rdx, str.Failed_to_open_DLL_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
mov rcx, rax
lea rdx, str.C:UsersUtilizadorDownloadsReleaseBlankDllTotest.dll
call fcn.140001a70
mov rcx, rax
lea rdx, [0x1400045d4]
jmp 0x14000156c
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [rsi - 1]
cmp ecx, 0xfffffffd
ja 0x140001540
mov ecx, esi
call fcn.1400020f0
mov rbp, rax
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xa0]
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001508
cmp dword [rsp + 0xa0], esi
jne 0x140001508
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x5a4d
cmp word [rbp], ax
jne 0x1400014f3
movsxd rcx, dword [rbp + 0x3c]
cmp rcx, 0x40
jb 0x1400014c2
cmp ecx, esi
jae 0x1400014c2
lea rsi, [rcx + rbp]
test rsi, rsi
je 0x1400014ad
cmp dword [rsi], 0x4550
jne 0x1400014ad
mov eax, dword [rsi + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa8], r12
lea rdx, str.NtAllocateVirtualMemory
call fcn.140001020
test rax, rax
jne 0x1400012de
lea rdx, str.Failed_to_resolve_NtAllocateVirtualMemory__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
jmp 0x140001524
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rsp + 0xa8]
mov rcx, r14
call rax
mov ebx, eax
test eax, eax
js 0x14000146e
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14000146e
movzx ebx, word [rsi + 0x14]
add rbx, 0x18
add rbx, rsi
movzx edi, r12w
cmp r12w, word [rsi + 6]
jae 0x140001372
mov eax, dword [rbx + 0x10]
test eax, eax
je 0x140001365
mov edx, dword [rbx + 0xc]
add rdx, rcx
mov r8d, dword [rbx + 0x14]
add r8, rbp
mov r9d, eax
mov qword [rsp + 0x20], r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000139b
mov rcx, qword [rsp + 0xa8]
inc di
add rbx, 0x28
cmp di, word [rsi + 6]
jb 0x140001334
lea rdx, str.NtProtectVirtualMemory
call fcn.140001020
test rax, rax
jne 0x1400013cd
lea rdx, str.Failed_to_resolve_NtProtectVirtualMemory__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
jmp 0x140001524
lea rdx, str.Failed_to_write_section
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
mov rdx, rbx
mov rcx, rax
call fcn.140001a70
lea rdx, str._to_target_process__n
mov rcx, rax
call fcn.140001a70
jmp 0x140001524
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xa8]
mov rcx, r14
call rax
mov ebx, eax
test eax, eax
jns 0x140001401
lea rdx, str.Failed_to_change_memory_protection_to_executable_with_status:
jmp 0x140001475
lea rdx, str.NtQueueApcThread
call fcn.140001020
test rax, rax
jne 0x14000142a
lea rdx, str.Failed_to_resolve_NtQueueApcThread__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
jmp 0x140001524
mov edx, dword [rsi + 0x28]
add rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call rax
mov ebx, eax
test eax, eax
jns 0x140001454
lea rdx, str.Failed_to_queue_APC_to_target_thread_with_status:
jmp 0x140001475
lea rdx, str.DLL_successfully_injected__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a70
mov bl, 1
jmp 0x140001526
lea rdx, str.Memory_allocation_in_target_process_failed_with_status:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
lea rdx, section..text
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400046fc]
call fcn.140001a70
jmp 0x140001524
lea rdx, str.Invalid_NT_signature__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
jmp 0x140001524
lea rdx, str.Invalid_e_lfanew_offset:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
mov edx, dword [rbp + 0x3c]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140001c50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001524
lea rdx, str.Invalid_DOS_signature_for_the_provided_module_base__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
jmp 0x140001524
lea rdx, str.Failed_to_read_DLL_file_contents__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rcx, rbp
call fcn.140002080
movzx eax, bl
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rdx, str.Invalid_DLL_file_size__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001571
lea rdx, str.Invalid_arguments_provided_to_InjectDLL__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
xor al, al
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret