Function at 0x180001760
Capabilities:
Acquire debug privileges
Check if file exists
Check mutex on windows
Create thread
Enumerate process modules
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
mov r15, rdx
lea r8, str.auto_mutex
mov r14d, ecx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x1800017ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov qword [rsp + 0x440], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xorps xmm0, xmm0
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x70], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
movups xmmword [rbp + 0xb0], xmm0
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x18000cbf0], rax
test rax, rax
jne 0x180001828
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_create_g_event._Error_code:
mov edi, eax
call fcn.1800030f0
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1800032c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x180001dd4
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1800018b6
lea r9, [rbp + 0x90]
mov r8d, 8
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
mov rcx, rdi
test eax, eax
je 0x1800018b0
mov rdx, qword [rsp + 0x78]
lea r8, [rbp + 0xe0]
mov r9d, 0x104
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0xc0]
call fcn.180005590
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [rbp + 0xc0]
movups xmm1, xmmword [rbp + 0xd0]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm1
jmp 0x1800018c7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x180008548]
lea rcx, [rsp + 0x50]
call fcn.180005590
cmp qword [rsp + 0x68], 7
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rsi
lea r8, [0x1800052d0]
cmova r9, qword [rsp + 0x50]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x180001940
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000193b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000193b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180005710
mov rcx, qword [0x18000cbf0]
mov edx, 0xffffffff
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], si
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x18000cbf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x70]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800019e9
lea r8, [rbp + 0xb4]
mov dword [rbp + 0xb0], 1
lea rdx, str.SeDebugPrivilege
mov dword [rbp + 0xbc], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1800019de
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 0xb0]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x180001a1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenProcess_failed:_0x_X_n
call fcn.180001020
jmp 0x180001dd4
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180001a39
lea rcx, str.Dll_file_doesnt_exist_n
call fcn.180001020
jmp 0x180001dd4
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.180002b50
mov rax, qword [rbp - 0x80]
movsxd rdx, dword [rax + 4]
test byte [rbp + rdx - 0x70], 6
je 0x180001aa8
mov edx, dword [rbp + rdx - 0x70]
lea rcx, str.Opening_the_file_failed:__X_n
call fcn.180001020
lea rcx, [rbp - 0x70]
call fcn.180002fa0
test rax, rax
jne 0x180001dcb
mov rax, qword [rbp - 0x80]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edx, [r8 + 2]
lea rax, [rbp - 0x80]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
jmp 0x180001dcb
lea rdx, [rbp + 0x98]
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov rcx, qword [rbp + 0x98]
add rcx, qword [rbp + 0xa0]
cmp rcx, 0x1000
jge 0x180001ade
lea rcx, str.Filesize_invalid._n
call fcn.180001020
jmp 0x180001a75
call fcn.1800058fc
xor r8d, r8d
lea rcx, [rbp - 0x80]
xor edx, edx
mov r14, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
mov r8, qword [rbp + 0xa0]
lea rcx, [rbp - 0x80]
add r8, qword [rbp + 0x98]
mov rdx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x70]
call fcn.180002fa0
test rax, rax
jne 0x180001b3a
mov rax, qword [rbp - 0x80]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edx, [r8 + 2]
lea rax, [rbp - 0x80]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.Mapping..._n
call fcn.180001020
lea rdx, [rbp + 0x90]
mov dword [rbp + 0x90], esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0x90], esi
je 0x180001c1e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0x90]
mov dword [rbp + 0x90], esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0x90], esi
je 0x180001c1e
lea rcx, str.Prepare_to_inject_Process_32_bit._n
call fcn.180001020
mov rcx, r15
call fcn.1800013a0
cmp eax, 0x8664
jne 0x180001bbc
lea rcx, str.32_bit_Process_cant_load_64_bit_dll_n
call fcn.180001020
jmp 0x180001dcb
mov r8, qword [rbp + 0xa0]
mov r9b, 1
add r8, qword [rbp + 0x98]
mov rdx, r14
mov qword [rsp + 0x40], rsi
mov rcx, rdi
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
call fcn.180003aa0
test al, al
jne 0x180001da9
mov rcx, r14
call fcn.180005710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Error_while_mapping._n
call fcn.180001020
jmp 0x180001dcb
lea rdx, [rbp + 0x90]
mov dword [rbp + 0x90], esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0x90], esi
je 0x180001c90
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0x90]
mov dword [rbp + 0x90], esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0x90], esi
jne 0x180001c90
lea rcx, str.Prepare_to_inject_Process_32_bit._n
call fcn.180001020
mov rcx, r15
call fcn.1800013a0
cmp eax, 0x8664
jne 0x180001bbc
lea rcx, str.32_bit_Process_cant_be_load_64_bit_dll_n
call fcn.180001020
jmp 0x180001dcb
lea rdx, [rbp + 0x90]
mov dword [rbp + 0x90], esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0x90], esi
jne 0x180001d32
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0x90]
mov dword [rbp + 0x90], esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0x90], esi
jne 0x180001d32
lea rcx, str.Prepare_to_inject_Process_64_bit._n
call fcn.180001020
mov rcx, r15
call fcn.1800013a0
cmp eax, 0x14c
je 0x180001d8f
mov r8, qword [rbp + 0xa0]
mov r9b, 1
add r8, qword [rbp + 0x98]
mov rdx, r14
mov qword [rsp + 0x40], rsi
mov rcx, rdi
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
call fcn.180004440
jmp 0x180001bf4
lea rdx, [rbp + 0x90]
mov dword [rbp + 0x90], esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0x90], esi
jne 0x180001da9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0x90]
mov dword [rbp + 0x90], esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0x90], esi
je 0x180001da9
lea rcx, str.Prepare_to_inject_Process_64_bit._n
call fcn.180001020
mov rcx, r15
call fcn.1800013a0
cmp eax, 0x14c
jne 0x180001d9d
lea rcx, str.64_bit_Process_cant_load_32_bit_dll_n
call fcn.180001020
jmp 0x180001dcb
lea rcx, str.Not_support_32_bit_to_64_bit_for_the_time_being._n
call fcn.180001020
mov rcx, r14
call fcn.180005710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Everything_is_OK_n
call fcn.180001020
mov esi, 1
lea rcx, [rbp - 0x80]
call fcn.180001e20
test rbx, rbx
je 0x180001deb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x440]
mov eax, esi
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.1800056f0
add rsp, 0x400
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret