Function at 0x140001c4a
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push rbp
push rbx
sub rsp, 0x1c8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x160], ecx
mov eax, dword [rbp + 0x160]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x138], rax
cmp qword [rbp + 0x138], 0
jne 0x140001ce4
lea rax, [rbp - 0x11]
mov qword [rbp + 0x108], rax
nop
nop
lea rdx, [rbp - 0x11]
lea rax, [rbp - 0x40]
mov r8, rdx
lea rdx, str.Failed_to_open_process_for_injection.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp - 0x11]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov eax, 0
jmp 0x140002282
mov rax, qword [section..data]
mov rcx, rax
call sym.wcslen
add rax, 1
add rax, rax
mov qword [rbp + 0x130], rax
mov rdx, qword [rbp + 0x130]
mov rax, qword [rbp + 0x138]
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x128], rax
cmp qword [rbp + 0x128], 0
jne 0x140001dab
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x100], rax
nop
nop
lea rdx, [rbp + 0x1f]
lea rax, [rbp - 0x10]
mov r8, rdx
lea rdx, str.Failed_to_allocate_memory_in_target_process.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0x1f]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov rax, qword [rbp + 0x138]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140002282
mov rcx, qword [section..data]
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x140001e7e
lea rax, [rbp + 0x4f]
mov qword [rbp + 0xf8], rax
nop
nop
lea rdx, [rbp + 0x4f]
lea rax, [rbp + 0x20]
mov r8, rdx
lea rdx, str.Failed_to_write_DLL_path_to_target_process_memory.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp + 0x20]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp + 0x20]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0x4f]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov rdx, qword [rbp + 0x128]
mov rax, qword [rbp + 0x138]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x138]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140002282
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov qword [rbp + 0x120], rax
cmp qword [rbp + 0x120], 0
jne 0x140001f35
lea rax, [rbp + 0x7f]
mov qword [rbp + 0xf0], rax
nop
nop
lea rdx, [rbp + 0x7f]
lea rax, [rbp + 0x50]
mov r8, rdx
lea rdx, str.Failed_to_get_handle_to_kernel32.dll.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp + 0x50]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp + 0x50]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0x7f]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov rdx, qword [rbp + 0x128]
mov rax, qword [rbp + 0x138]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x138]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140002282
mov rax, qword [rbp + 0x120]
lea rdx, str.LoadLibraryW
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x118], rax
cmp qword [rbp + 0x118], 0
jne 0x140002005
lea rax, [rbp + 0xaf]
mov qword [rbp + 0xe8], rax
nop
nop
lea rdx, [rbp + 0xaf]
lea rax, [rbp + 0x80]
mov r8, rdx
lea rdx, str.Failed_to_get_address_of_LoadLibraryW_function.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp + 0x80]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp + 0x80]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0xaf]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov rdx, qword [rbp + 0x128]
mov rax, qword [rbp + 0x138]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x138]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140002282
mov rcx, qword [rbp + 0x118]
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rdx, qword [rbp + 0x128]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x110], rax
cmp qword [rbp + 0x110], 0
jne 0x140002100
lea rax, [rbp + 0xdf]
mov qword [rbp + 0xe0], rax
nop
nop
lea rdx, [rbp + 0xdf]
lea rax, [rbp + 0xb0]
mov r8, rdx
lea rdx, str.Failed_to_create_remote_thread_in_target_process.
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.LogError_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0xdf]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
mov rdx, qword [rbp + 0x128]
mov rax, qword [rbp + 0x138]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x138]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140002282
mov rax, qword [rbp + 0x110]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x110]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rdx, qword [rbp + 0x128]
mov rax, qword [rbp + 0x138]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x138]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140002282
add rsp, 0x1c8
pop rbx
pop rbp
ret