Function at 0x140001290
Capabilities:
Create thread
Enumerate processes
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3e0]
sub rsp, 0x4e0
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
mov r15, rdx
cmp ecx, 3
je 0x1400012fe
lea rdx, str.Usage:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a30
mov rcx, rax
mov rdx, qword [r15]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, str.__dpath_
jmp 0x140001880
lea rdx, str.dpath:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001c40
mov rcx, rax
mov rdx, qword [r15 + 8]
call fcn.140001eb0
mov rcx, rax
lea rdx, [0x140002090]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor r9d, r9d
lea r8, [rbp + 0x1c0]
mov edx, 0x104
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
dec eax
cmp eax, 0x102
ja 0x140001872
lea rdx, str.Full_Path:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001c40
mov rcx, rax
lea rdx, [rbp + 0x1c0]
call fcn.140001eb0
mov rcx, rax
lea rdx, [0x140002090]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor r12d, r12d
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
lea rax, [rbp + 0x1c0]
mov rsi, 0xffffffffffffffff
mov rbx, rsi
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x1400013b0
movabs r14, 0x7ffffffffffffffe
cmp rbx, r14
ja 0x1400018d0
movabs r13, 0x7fffffffffffffff
mov qword [rsp + 0x78], 7
cmp rbx, 8
jae 0x14000140d
mov qword [rsp + 0x70], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x60], r12w
jmp 0x1400014b2
mov rax, rbx
or rax, 7
cmp rax, r14
jbe 0x140001423
lea rcx, [r13*2]
jmp 0x14000144b
mov r14, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, r13
ja 0x1400018ca
add rcx, rcx
cmp rcx, 0x1000
jb 0x140001477
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400018ca
mov rcx, rax
call fcn.1400022b0
test rax, rax
je 0x140001862
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001489
test rcx, rcx
je 0x140001486
call fcn.1400022b0
mov rdi, rax
jmp 0x140001489
mov rdi, r12
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], r14
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x1c0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
lea r14, [rdx + rax*2]
lea rdi, [rsp + 0x60]
cmovae rdi, qword [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
cmp rdi, r14
jne 0x1400014fc
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
jmp 0x1400015f7
mov rax, r14
sub rax, rdi
sar rax, 1
mov rdx, r12
mov qword [rsp + 0x50], rdx
mov ebx, 0xf
mov qword [rsp + 0x58], rbx
cmp rax, r13
ja 0x1400018d6
cmp rax, 0x10
jb 0x1400015b0
mov rbx, rax
or rbx, 0xf
cmp rbx, r13
jbe 0x14000153b
mov rbx, r13
jmp 0x140001547
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, rsi
cmp rcx, 0x1000
jb 0x14000158f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400018dc
mov rcx, rax
call fcn.1400022b0
mov rcx, rax
test rax, rax
je 0x14000180a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x50]
jmp 0x1400015a3
test rcx, rcx
je 0x1400015a0
call fcn.1400022b0
mov rdx, qword [rsp + 0x50]
jmp 0x1400015a3
mov rax, r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rbx
nop dword [rax]
lea rcx, [rsp + 0x40]
cmp rbx, 0x10
cmovae rcx, qword [rsp + 0x40]
movzx eax, byte [rdi]
mov byte [rdx + rcx], al
mov rdx, qword [rsp + 0x50]
inc rdx
mov qword [rsp + 0x50], rdx
add rdi, 2
cmp rdi, r14
je 0x1400015e2
mov rbx, qword [rsp + 0x58]
jmp 0x1400015b0
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rax, qword [rsp + 0x40]
mov byte [rdx + rax], 0
mov r15, qword [r15 + 0x10]
mov r14d, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov ebx, r12d
cmp rax, 0xffffffffffffffff
je 0x140001666
mov dword [rbp - 0x80], 0x238
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000165d
nop dword [rax]
mov rdx, r15
lea rcx, [rbp - 0x54]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000164c
mov r14d, dword [rbp - 0x78]
cmp ebx, 1
je 0x14000165d
inc ebx
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001630
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Process_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a30
mov rcx, rax
mov edx, r14d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001c00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rbx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rbx, qword [rsp + 0x40]
xor r15b, r15b
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400017b2
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x140001794
lea rsi, [rsi + 1]
cmp byte [rbx + rsi], r15b
jne 0x1400016f0
lea r9, [rsi + 1]
mov qword [rsp + 0x20], r12
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000177f
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000177f
lea rdx, str.LoadLibraryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000177f
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x14000177f
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15b, 1
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15b, r15b
je 0x1400017b2
lea rdx, str.Inside_of_her_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x1400017c0
lea rdx, str.pulled_out.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a30
lea rdx, [0x140001c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140001816
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001811
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001811
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022ec
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14000186e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001869
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001869
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022ec
xor eax, eax
jmp 0x14000189a
lea rdx, str.Error_getting_full_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a30
lea rdx, [0x140001c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.140002290
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001110
int3
call fcn.1400011b0
nop
call fcn.1400011b0
nop
call fcn.140001110
int3