Function at 0x1400011c0
Capabilities:
Create process on windows
Create thread
Enumerate processes
Get common file path
Inject dll
Inject thread

Disassembly:
push rbp
push rbx
push rsi
push r12
lea rbp, [rsp - 0x3a8]
sub rsp, 0x4a8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x390], rax
xorps xmm0, xmm0
mov dword [rbp - 0x30], 0x68
xor eax, eax
lea rdx, [rbp + 0x170]
mov ecx, 0x104
mov dword [rbp + 0x34], eax
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xorps xmm0, xmm0
lea rax, [rbp + 0x170]
mov rsi, 0xffffffffffffffff
movups xmmword [rbp - 0x50], xmm0
mov rbx, rsi
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001237
mov qword [rsp + 0x4d0], rdi
movabs r12, 0x7fffffffffffffff
mov qword [rsp + 0x4d8], r13
mov qword [rsp + 0x4e0], r14
mov qword [rsp + 0x4a0], r15
cmp rbx, r12
ja 0x1400019af
xor r14d, r14d
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp rbx, 0xf
ja 0x1400012c0
mov r8, rbx
mov qword [rbp - 0x40], rbx
lea rdx, [rbp + 0x170]
mov qword [rbp - 0x38], 0xf
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x50], r14b
mov rdi, qword [rbp - 0x38]
mov rbx, qword [rbp - 0x40]
mov r15, qword [rbp - 0x50]
jmp 0x140001349
mov rdi, rbx
or rdi, 0xf
cmp rdi, r12
jbe 0x1400012d5
mov rdi, r12
add rax, 0x27
jmp 0x1400012f6
cmp rdi, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001315
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019b5
mov rcx, rax
call fcn.140001df0
test rax, rax
je 0x140001962
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140001327
test rcx, rcx
je 0x140001324
call fcn.140001df0
mov r15, rax
jmp 0x140001327
mov r15, r14
mov r8, rbx
mov qword [rbp - 0x50], r15
lea rdx, [rbp + 0x170]
mov qword [rbp - 0x40], rbx
mov rcx, r15
mov qword [rbp - 0x38], rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rbx], r14b
mov rax, r12
sub rax, rbx
cmp rax, 0x14
jb 0x1400019af
cmp rdi, 0xf
mov qword [rbp - 0x60], r14
lea rax, [rbp - 0x50]
mov qword [rbp - 0x58], r14
cmova rax, r15
lea r13, [rbx + 0x14]
mov r14d, 0xf
mov qword [rsp + 0x50], rax
lea r12, [rbp - 0x70]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
cmp r13, r14
jbe 0x140001420
mov r14, r13
movabs rcx, 0x7fffffffffffffff
or r14, 0xf
cmp r14, rcx
jbe 0x1400013b9
movabs rax, 0x8000000000000000
mov r14, rcx
add rax, 0x27
jmp 0x1400013e0
cmp r14, 0x16
mov ecx, 0x16
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x140001405
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019b5
mov rcx, rax
call fcn.140001df0
test rax, rax
je 0x140001962
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
mov rax, qword [rsp + 0x50]
jmp 0x14000141c
test rcx, rcx
je 0x140001419
call fcn.140001df0
mov r12, rax
mov rax, qword [rsp + 0x50]
jmp 0x14000141c
xor r12d, r12d
mov qword [rbp - 0x70], r12
mov r8, rbx
mov qword [rbp - 0x60], r13
mov rdx, rax
mov qword [rbp - 0x58], r14
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [0x140003440]
cmp rdi, 0xf
mov r14d, 0xf
movups xmmword [rbx + r12], xmm0
mov eax, dword [0x140003450]
mov dword [rbx + r12 + 0x10], eax
xorps xmm0, xmm0
mov byte [r12 + r13], 0
lea rax, [rbp - 0x50]
cmova rax, r15
lea r13, [rbx + 0xa]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x80], rdx
lea r12, [rsp + 0x70]
mov qword [rbp - 0x78], rdx
movups xmmword [rsp + 0x70], xmm0
cmp r13, r14
jbe 0x14000151e
mov r14, r13
movabs rcx, 0x7fffffffffffffff
or r14, 0xf
cmp r14, rcx
jbe 0x1400014d9
movabs rax, 0x8000000000000000
mov r14, rcx
add rax, 0x27
mov rcx, rax
call fcn.140001df0
test rax, rax
je 0x140001962
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
mov rax, qword [rsp + 0x50]
jmp 0x140001519
cmp r14, 0x16
mov ecx, 0x16
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x140001502
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019b5
jmp 0x1400014b4
test rcx, rcx
je 0x140001516
call fcn.140001df0
mov r12, rax
mov rax, qword [rsp + 0x50]
jmp 0x140001519
mov r12, rdx
mov qword [rsp + 0x70], r12
mov r8, rbx
mov qword [rbp - 0x80], r13
mov rdx, rax
mov qword [rbp - 0x78], r14
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.Hooks.dll]
lea rdx, str.Lossless_Exe:
movsd qword [rbx + r12], xmm0
movzx eax, word [0x140003460]
mov word [rbx + r12 + 8], ax
mov byte [r12 + r13], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a30
cmp qword [rbp - 0x58], 0xf
lea rdx, [rbp - 0x70]
mov r8, qword [rbp - 0x60]
mov rcx, rax
cmova rdx, qword [rbp - 0x70]
call fcn.140001c00
lea rdx, str._nHooks_dll:
mov rcx, rax
call fcn.140001a30
cmp qword [rbp - 0x78], 0xf
lea rdx, [rsp + 0x70]
mov r8, qword [rbp - 0x80]
mov rcx, rax
cmova rdx, qword [rsp + 0x70]
call fcn.140001c00
mov rcx, rax
lea rdx, [0x140003464]
call fcn.140001a30
cmp qword [rbp - 0x58], 0xf
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rcx, [rbp - 0x70]
cmova rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
xor r13d, r13d
mov qword [rsp + 0x38], r13
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], r13d
xor edx, edx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140001852
mov rcx, qword [rsp + 0x58]
mov edx, 0xc8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [rbp - 0x78], 0xf
lea rbx, [rsp + 0x70]
cmova rbx, qword [rsp + 0x70]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x40], 0x130
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000167a
nop
lea rdx, str.LosslessScaling.exe
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, r14
test eax, eax
je 0x1400017d8
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001650
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r13d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140001805
mov r8, rsi
inc r8
cmp byte [rbx + r8], r13b
jne 0x1400016a2
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
test rax, rax
je 0x1400017e7
mov r9, rsi
inc r9
cmp byte [rbx + r9], r13b
jne 0x1400016d6
inc r9
mov qword [rsp + 0x20], r13
mov r8, rbx
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], r13d
xor edx, edx
mov qword [rsp + 0x20], r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r13, rax
test rax, rax
je 0x1400017b5
mov edx, 0xc8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax]
cmp byte [rbx + rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x140001750
lea r9, [rsi + 1]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x280]
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Allocated_space_value:
call fcn.140001a30
mov rcx, rax
lea rdx, [rbp + 0x280]
call fcn.140001a30
mov rcx, rax
lea rdx, [0x140003464]
call fcn.140001a30
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, r14
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000183a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0x48]
jmp 0x140001686
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_allocate_memory_in_the_remote_process_n
call fcn.140001a30
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000183a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.OpenProcess_failed_with_error
mov ebx, eax
call fcn.140001a30
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003464]
call fcn.140001a30
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400018a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.CreateProcess_failed_with_error
mov ebx, eax
call fcn.140001a30
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003464]
call fcn.140001a30
mov r9d, 0x10
lea r8, str.Fail_
lea rdx, str.Cannot_open_lossless_process_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400018df
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018da
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001962
call fcn.140001e2c
mov rdx, qword [rbp - 0x58]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
cmp rdx, 0xf
jbe 0x140001927
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001922
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001962
call fcn.140001e2c
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
cmp rdi, 0xf
jbe 0x140001971
lea rdx, [rdi + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001969
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001969
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.140001e2c
mov r15, qword [rsp + 0x4a0]
xor eax, eax
mov r14, qword [rsp + 0x4e0]
mov r13, qword [rsp + 0x4d8]
mov rdi, qword [rsp + 0x4d0]
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.140001dd0
add rsp, 0x4a8
pop r12
pop rsi
pop rbx
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3