Function at 0x140034c80
Capabilities:
Access pe header

Disassembly:
push rbp
push r15
sub rsp, 0x58
mov rbp, rcx
lea rcx, [0x140097730]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r15, rax
test rax, rax
jne 0x140034cc4
lea r8, str.pe:_invalid_pe_header
lea rdx, str.SquadHackInject
lea rcx, [0x14004929c]
call fcn.14002e490
xor al, al
add rsp, 0x58
pop r15
pop rbp
ret
mov qword [rsp + 0x70], rbx
xor ebx, ebx
mov qword [rsp + 0x80], rsi
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x88], rdi
nop
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, 0x14
mov esi, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [rsp + 0x78]
test edi, edi
je 0x140034ce0
test esi, esi
je 0x14003506c
mov rcx, qword gs:[0x58]
mov eax, dword [0x1401a90e8]
mov qword [rsp + 0x50], r14
mov r14d, 4
add r14, qword [rcx]
cmp eax, dword [r14]
jle 0x140034d7e
lea rcx, [0x1401a90e8]
call fcn.14003d9dc
mov eax, dword [0x1401a90e8]
cmp eax, 0xffffffff
jne 0x140034d7e
lea rcx, [0x14003f6d0]
mov dword [0x1401a90f0], ebx
mov qword [0x1401a90f8], 0xffffffffffffffff
call fcn.14003dd24
lea rcx, [0x1401a90e8]
call fcn.14003d97c
mov eax, dword [0x1401a90e8]
mov dword [0x1401a90f0], edi
cmp eax, dword [r14]
jle 0x140034dc7
lea rcx, [0x1401a90e8]
call fcn.14003d9dc
cmp dword [0x1401a90e8], 0xffffffff
jne 0x140034dc7
lea rcx, [0x14003f6d0]
mov dword [0x1401a90f0], ebx
mov qword [0x1401a90f8], 0xffffffffffffffff
call fcn.14003dd24
lea rcx, [0x1401a90e8]
call fcn.14003d97c
mov edx, dword [r15 + 0x50]
lea rcx, [0x1401a90f0]
call fcn.140001300
mov r8, r15
mov rcx, rax
mov rdi, rax
call fcn.140034660
test eax, eax
jne 0x140034eb7
mov edx, dword [r14]
cmp dword [0x1401a90e8], edx
jle 0x140034e36
lea rcx, [0x1401a90e8]
call fcn.14003d9dc
cmp dword [0x1401a90e8], 0xffffffff
jne 0x140034e36
lea rcx, [0x14003f6d0]
mov dword [0x1401a90f0], ebx
mov qword [0x1401a90f8], 0xffffffffffffffff
call fcn.14003dd24
lea rcx, [0x1401a90e8]
call fcn.14003d97c
mov rcx, qword [0x1401a90f8]
mov eax, dword [0x1401a90f0]
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rdi
cmp rcx, 0xffffffffffffffff
jne 0x140034e5f
mov rbx, 0xffffffffc00000c0
jmp 0x140034e95
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
mov r9d, 0x10
mov dword [rsp + 0x28], ebx
mov edx, 0x3009d4e0
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov rcx, 0xffffffffc0000001
cmove rbx, rcx
mov r8, rbx
lea rdx, str.send_serivce
lea rcx, [0x14004929c]
call fcn.14002e490
lea r8, str.reloc_fail
jmp 0x140034fa8
lea r8, str.relocate_image_success_
lea rdx, str.SquadHackInject
lea rcx, [0x14004929c]
call fcn.14002e490
mov r8, r15
mov ecx, esi
call fcn.1400347f0
test eax, eax
jne 0x140034fdf
mov eax, dword [r14]
cmp dword [0x1401a90e8], eax
jle 0x140034f2c
lea rcx, [0x1401a90e8]
call fcn.14003d9dc
cmp dword [0x1401a90e8], 0xffffffff
jne 0x140034f2c
lea rcx, [0x14003f6d0]
mov dword [0x1401a90f0], ebx
mov qword [0x1401a90f8], 0xffffffffffffffff
call fcn.14003dd24
lea rcx, [0x1401a90e8]
call fcn.14003d97c
mov rcx, qword [0x1401a90f8]
mov eax, dword [0x1401a90f0]
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rdi
cmp rcx, 0xffffffffffffffff
jne 0x140034f55
mov rbx, 0xffffffffc00000c0
jmp 0x140034f8b
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
mov r9d, 0x10
mov dword [rsp + 0x28], ebx
mov edx, 0x3009d4e0
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov rcx, 0xffffffffc0000001
cmove rbx, rcx
mov r8, rbx
lea rdx, str.send_serivce
lea rcx, [0x14004929c]
call fcn.14002e490
lea r8, str.import_failed_
lea rdx, str.SquadHackInject
lea rcx, [0x14004929c]
call fcn.14002e490
xor al, al
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
add rsp, 0x58
pop r15
pop rbp
ret
mov r8, r15
mov rcx, rdi
call fcn.140034a60
mov r8, r15
mov rdx, rdi
mov ecx, esi
call fcn.140034150
lea r8, str.call_dll_main_success_
lea rdx, str.SquadHackInject
lea rcx, [0x14004929c]
call fcn.14002e490
mov rdx, r15
mov rcx, rdi
call fcn.140034b50
xor edx, edx
lea rcx, [0x140097730]
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r8, str.cleanup_success_
lea rdx, str.SquadHackInject
lea rcx, [0x14004929c]
call fcn.14002e490
lea r8, str.inject_success_
lea rdx, str.SquadHackInject
lea rcx, [0x14004929c]
call fcn.14002e490
mov al, 1
jmp 0x140034fbd
lea r8, str.process_not_found_
lea rdx, str.SquadHackInject
lea rcx, [0x14004929c]
call fcn.14002e490
xor al, al
jmp 0x140034fc2