Function at 0x1800020c0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18000a040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov qword [rbp - 0x50], rcx
movsd xmm0, qword [0x180006568]
movsd qword [rbp - 0x20], xmm0
mov eax, dword [0x180006570]
mov dword [rbp - 0x18], eax
movzx eax, word [0x180006574]
mov word [rbp - 0x14], ax
movzx eax, byte [0x180006576]
mov byte [rbp - 0x12], al
movsd xmm0, qword [str.CreateEventW]
movsd qword [rbp - 0x30], xmm0
mov eax, dword [0x180006580]
mov dword [rbp - 0x28], eax
movzx eax, byte [0x180006584]
mov byte [rbp - 0x24], al
xor r13d, r13d
mov qword [rbp - 0x40], r13
mov rsi, qword gs:[0x60]
mov rax, qword [rsi + 0x18]
add rax, 0x20
mov rbx, qword [rax]
cmp rbx, rax
je 0x18000218c
lea rdx, str.KERNELBASE.dll
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x180002232
mov rbx, qword [rbx]
mov rax, qword [rsi + 0x18]
add rax, 0x20
cmp rbx, rax
jne 0x180002162
lea rdx, [0x1800065a8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003ac0
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.180003ac0
mov rcx, rax
lea rdx, [0x180003c90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x180002200
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800021f0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002734
mov rcx, r8
call fcn.180004190
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov eax, 0xfffffffe
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180004170
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x18000218c
lea rdx, [0x1800065c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003ac0
mov rcx, rax
lea rdx, [0x180003c90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call fcn.180001cc0
mov r15, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x180002295
lea rdx, str.___
call fcn.180003ac0
mov rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
jmp 0x1800021ab
lea rdx, str.__
call fcn.180003ac0
mov rcx, rax
mov rdx, r15
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x180003c90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x1f04
lea rcx, str.___Trying_to_open_process_with_pid:__d_n
call fcn.180001040
xor edx, edx
mov ecx, 0x1fffff
mov r8d, 0x1f04
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov edx, 0x1f04
test rax, rax
jne 0x1800022fc
lea rcx, str.___ERROR__Could_not_open_process_with_pid__d_n
call fcn.180001040
jmp 0x18000237b
lea rcx, str._____Successfully_opened_process_with_pid__d_n_n
call fcn.180001040
lea rcx, str.___Trying_to_find_memory_holes_n
call fcn.180001040
mov rax, qword [rdi + 8]
sub rax, qword [rdi]
mov rsi, r15
and rsi, 0xfffffffffff70000
sub rsi, 0x70000000
lea rbx, [r15 + 0x70000000]
cmp rsi, rbx
jae 0x18000236e
add eax, 0x38
movsxd r12, eax
nop
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, r12
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
jne 0x1800023c9
add rsi, 0x10000
cmp rsi, rbx
jb 0x180002340
lea rcx, str.___Error__Could_not_find_memory_hole_n
call fcn.180001040
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800023bf
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800023af
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002734
mov rcx, r8
call fcn.180004190
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov eax, 0xffffff9d
jmp 0x180002205
mov rdx, rsi
lea rcx, str._____Found_Memory_Hole:__p_n
call fcn.180001040
test rsi, rsi
je 0x18000236e
lea rdx, str.___VirtualAlloc_memory_success_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003ac0
mov rcx, rax
lea rdx, [0x180003c90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp - 0x30]
lea rcx, str.___Reading_bytes_from_the_memory_address_of__s_n
call fcn.180001040
mov rbx, qword [r15]
mov r8, rbx
mov rdx, r15
lea rcx, str._____Address__p_has_value___lld_n_n
call fcn.180001040
lea rcx, str.___Generating_hook
call fcn.180001040
mov qword [0x18000a0ba], rbx
lea rcx, str._____Hook_successfully_placed
call fcn.180001040
lea rdx, [rbp - 0x30]
lea rcx, str.___Changing_the_memory_protection_of__s_to_RWX_n
call fcn.180001040
mov dword [rbp - 0x48], r13d
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x180002487
lea rcx, str.___Error__Could_not_change_the_memory_protection_settings_n
jmp 0x180002375
lea rdx, [rbp - 0x30]
lea rcx, str._____Successfully_changed_the_memory_protection_settings_of__s_to_RWX_n
call fcn.180001040
lea rcx, str.___Trying_to_inject_the_call_assembly_for_the_exported_function_n
call fcn.180001040
mov eax, esi
sub eax, r15d
sub eax, 5
mov byte [rbp - 0x38], pe_nt_image_headers64
mov dword [rbp - 0x37], eax
mov qword [rsp + 0x20], r13
mov r9d, 0x40
lea r8d, [r9 - 0x3b]
lea rdx, [rbp - 0x38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 5
lea r8, [rbp - 0x38]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rbp - 0x30]
test eax, eax
jne 0x180002506
lea rcx, str.___Error__Could_redirect__s_n
call fcn.180001040
jmp 0x18000237b
lea rcx, str._____Successfully_modified__s_function_to_call_the_custom_shellcode_n
call fcn.180001040
mov r15, qword [rdi + 8]
sub r15, qword [rdi]
add r15d, 0x38
lea rdx, [0x1800068f8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003ac0
mov rcx, rax
mov edx, r15d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180003c90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movsxd r12, r15d
mov rcx, r12
call fcn.18000449c
mov rbx, rax
mov rcx, qword [rdi]
mov r8, qword [rdi + 8]
sub r8, rcx
add rax, 0x37
lea rdx, [0x18000a0df]
cmp rbx, rdx
ja 0x1800025a3
lea r10, [0x18000a0a8]
cmp rax, r10
jb 0x1800025a3
mov rdx, rbx
sub r10, rbx
mov r9d, 0x38
nop dword [rax]
movzx eax, byte [r10 + rdx]
mov byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x180002590
jmp 0x1800025d0
movups xmm0, xmmword [0x18000a0a8]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x18000a0b8]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [0x18000a0c8]
movups xmmword [rbx + 0x20], xmm0
movsd xmm1, qword [0x18000a0d8]
movsd qword [rbx + 0x30], xmm1
test r8, r8
je 0x1800025f1
mov rdx, rbx
sub rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx + 0x38], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x1800025e0
lea rdx, [0x180006908]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003ac0
mov rcx, rax
mov edx, r15d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180006900]
call fcn.180003ac0
mov rdx, rbx
mov rcx, rax
call fcn.180003ac0
mov rcx, rax
lea rdx, [0x180003c90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8, r12
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdx, rsi
test eax, eax
jne 0x180002670
lea rcx, str._Error__Modifying_the_memory_protection_of_the_memory_hole:__p_before_write_n
call fcn.180001040
jmp 0x18000237b
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9, r12
mov r8, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, rsi
test eax, eax
jne 0x1800026a0
lea rcx, str._Error__Writing_to_the_memory_hole_address:__p_n
call fcn.180001040
jmp 0x18000237b
movsxd r8, r15d
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1800026d3
mov rdx, rsi
lea rcx, str._Error__Modifying_the_memory_protection_of_the_memory_hole:__p_after_write_n
call fcn.180001040
jmp 0x18000237b
lea rcx, str._n___Injection_successful__wait_for_your_trigger_function__n
call fcn.180001040
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x180002205
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18000271f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002734
mov rcx, r8
call fcn.180004190
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
jmp 0x180002205
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3