Function at 0x140001070
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Connect pipe
Create pipe
Get file size
Read file on windows

Disassembly:
mov r11, rsp
push rbx
push r15
sub rsp, 0x198
mov rax, qword [0x14001e008]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor r15d, r15d
xorps xmm0, xmm0
mov qword [rsp + 0x48], r15
mov rbx, rdx
mov dword [rsp + 0x44], r15d
movups xmmword [rsp + 0x60], xmm0
cmp ecx, 4
jl 0x140001575
mov rcx, qword [rdx + 8]
mov qword [r11 + 8], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x18], r12
call fcn.14000536c
mov rbp, qword [rbx + 0x18]
mov r12d, eax
mov rax, qword [rbx + 0x10]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov rcx, rax
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000112a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_open_the_DLL_file
lea rcx, str._____s._Error_d
call fcn.140001010
xor eax, eax
jmp 0x14000128a
xor edx, edx
mov qword [rsp + 0x180], r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
lea ecx, [r14 - 1]
cmp ecx, 0xfffffffd
ja 0x140001552
mov qword [rsp + 0x1c8], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r14d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x140001192
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_get_the_DLL_file_size
lea rcx, str._____s._Error_d
call fcn.140001010
jmp 0x140001278
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], r15
mov r8d, r14d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400011c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_alloc_a_buffer_
jmp 0x140001255
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x48]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001230
lea r8, [rsp + 0x64]
mov dword [rsp + 0x60], 1
lea rdx, str.SeDebugPrivilege
mov dword [rsp + 0x6c], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140001225
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r12d
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x1400012bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_open_the_target_process
mov r8d, eax
lea rcx, str._____s._Error_d
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rdi, qword [rsp + 0x1c8]
mov r14, qword [rsp + 0x180]
mov rsi, qword [rsp + 0x1c0]
mov rbp, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140001a00
add rsp, 0x198
pop r15
pop rbx
ret
mov qword [rsp + 0x188], r13
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rbx + rbp], r15b
jne 0x1400012d0
mov r9d, 0x3000
mov r8d, ebx
xor edx, edx
mov r13d, ebx
mov rcx, rsi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
jne 0x140001321
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str._t_t____FAILED_to_allocate_memory_in_process._n
lea rcx, str._____s._Error_d
call fcn.140001010
jmp 0x140001526
mov r8d, r12d
lea rcx, str.___Memory_allocated_at_:_0x_d_in_process__d_n
mov rdx, r15
call fcn.140001010
mov edx, r12d
lea rcx, str.___Attempting_to_write_parameter_in__process__d__n
call fcn.140001010
lea rax, [rsp + 0x50]
mov r9, r13
mov r8, rbp
mov qword [rsp + 0x20], rax
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001384
mov rdx, qword [rsp + 0x50]
lea rcx, str.____FAILED_to_write_parameter._Wrote__d__bytes_instead_of__d_bytes._n
mov r8d, ebx
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001526
mov edx, r12d
lea rcx, str.___Wrote_parameter_in_remote_process__d_memory._n
call fcn.140001010
mov r9, r15
mov r8d, r14d
mov rdx, rdi
mov rcx, rsi
call fcn.1400018f0
mov rbp, rax
test rax, rax
jne 0x1400013cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_inject_the_DLL
lea rcx, str._____s._Error_d
call fcn.140001010
jmp 0x140001526
mov rdx, qword [rsp + 0x58]
lea rcx, str.___Injected_the__s_DLL_into_process__d._n
mov r8d, r12d
call fcn.140001010
xor ecx, ecx
call fcn.14000542c
mov ecx, eax
call fcn.1400037d8
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x100
call fcn.140002c00
xor r14d, r14d
lea rcx, str..Pipemypipe
mov qword [rsp + 0x38], r14
mov r9d, 0xff
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], r14d
lea edx, [r14 + 3]
mov dword [rsp + 0x40], r14d
lea r8d, [r14 + 6]
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000145d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___Create_Pipe_Error__d__n
call fcn.140001010
jmp 0x140001518
lea rcx, str.___Create_Pipe_Success_n
call fcn.140001010
lea rcx, str.___Waiting_For_Client_Connection..._n
call fcn.140001010
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
lea rdx, str.___Connection_Success__n
lea rcx, str.___Connection_failed__n
cmovne rcx, rdx
call fcn.140001010
lea rcx, str.___Data_From_Pipe_:_n_n
call fcn.140001010
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov r8d, 0x100
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001503
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [0x14001b4f8]
call fcn.140001010
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov r8d, 0x100
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400014d0
lea rcx, str._n___Read_Data_From_Pipe_End__n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x188]
xor eax, eax
jmp 0x14000127a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_get_the_DLL_file_size
lea rcx, str._____s._Error_d
call fcn.140001010
xor eax, eax
jmp 0x140001282
lea rcx, str.Usage:_inject.exe__dll_file___arg_
call fcn.140001010
xor eax, eax
jmp 0x1400012a2