Function at 0x140003540
Capabilities:
Create process on windows
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x360
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x140013040]
xor rax, rsp
mov qword [rsp + 0x330], rax
xor ebx, ebx
lea rcx, [rsp + 0xc0]
call fcn.140002e50
nop
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x140003597
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x108], rax
call fcn.14000970c
movaps xmm0, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x100], xmm0
lea r8, [rsp + 0x100]
mov edx, eax
lea rcx, [rsp + 0x150]
call fcn.140009500
nop
mov r8d, 0x13
lea rdx, str._Injector_workspace
lea rcx, [rsp + 0x150]
call fcn.140007800
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0x148], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x140], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x168]
cmp rdx, 0xf
jbe 0x14000367a
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003675
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003675
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], 0xf
mov byte [rsp + 0x150], 0
mov rdx, qword [rsp + 0xd8]
cmp rdx, 7
jbe 0x1400036e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400036dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], 7
mov word [rsp + 0xc0], bx
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], rbx
mov r8d, 0x14
lea rdx, str.RobloxPlayerBeta.exe
lea rcx, [rsp + 0x170]
call fcn.140005ba0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rbx
mov r8d, 0x24
lea rdx, str.cd57e4c171d6e8f5ea8b8f824a6a7316.exe
lea rcx, [rsp + 0x150]
call fcn.140005ba0
nop
mov r13, qword [rsp + 0x140]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0xb
jb 0x140004cd4
lea r12, [rsp + 0x130]
cmp qword [rsp + 0x148], 0xf
cmova r12, qword [rsp + 0x130]
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], rbx
lea r15, [r13 + 0xb]
mov edi, 0xf
lea rsi, [rsp + 0x110]
cmp r15, rdi
jbe 0x140003888
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400037f9
mov rdi, rcx
movabs r14, 0x8000000000000000
lea rax, [r14 + 0x27]
jmp 0x140003829
mov esi, 0x16
cmp rdi, rsi
cmovb rdi, rsi
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140003850
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004cda
movabs r14, 0x8000000000000000
mov rcx, rax
call fcn.14000a0f0
test rax, rax
je 0x140004bd1
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov qword [rsp + 0x110], rsi
jmp 0x140003892
test rcx, rcx
je 0x140003871
call fcn.14000a0f0
mov rsi, rax
movabs r14, 0x8000000000000000
mov qword [rsp + 0x110], rax
jmp 0x140003892
mov rsi, rbx
movabs r14, 0x8000000000000000
mov qword [rsp + 0x110], rbx
jmp 0x140003892
movabs r14, 0x8000000000000000
mov qword [rsp + 0x120], r15
mov qword [rsp + 0x128], rdi
mov r8, r13
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str._inject.txt]
movsd qword [rsi + r13], xmm0
movzx eax, word [0x14000ca10]
mov word [rsi + r13 + 8], ax
movzx eax, byte [0x14000ca12]
mov byte [rsi + r13 + 0xa], al
mov byte [rsi + r15], 0
lea rax, [rsp + 0x110]
cmp qword [rsp + 0x128], 0xf
cmova rax, qword [rsp + 0x110]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x108], rax
call fcn.14000970c
movaps xmm0, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x100], xmm0
lea r8, [rsp + 0x100]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140001c40
nop
lea rcx, [rsp + 0x80]
call fcn.140002a70
movzx edi, al
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140003997
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003992
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003992
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
test dil, dil
je 0x140003c5a
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbx
mov r8d, 0xa
lea rdx, str.AnonymeAPI
lea rcx, [rsp + 0xa0]
call fcn.140005ba0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
mov r8d, 0x11
lea rdx, str.Already_injected_
lea rcx, [rsp + 0xc0]
call fcn.140005ba0
lea r8, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova r8, qword [rsp + 0xa0]
lea rdx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 0xf
cmova rdx, qword [rsp + 0xc0]
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0xf
jbe 0x140003a91
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003a8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], 0xf
mov byte [rsp + 0xc0], 0
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x140003af4
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003aee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003aee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
nop
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140003b37
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004bd1
call fcn.14000a520
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], 0xf
mov byte [rsp + 0x110], 0
mov rdx, qword [rsp + 0x168]
cmp rdx, 0xf
jbe 0x140003b97
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004c33
call fcn.14000a520
nop
mov rdx, qword [rsp + 0x188]
cmp rdx, 0xf
jbe 0x140003bdb
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004c7a
call fcn.14000a520
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 0xf
jbe 0x140003c1e
inc rdx
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ccd
call fcn.14000a520
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.14000a0d0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rcx, [rsp + 0x170]
call fcn.140005200
test al, al
jne 0x140003f53
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8d, 0xa
lea rdx, str.AnonymeAPI
lea rcx, [rsp + 0x60]
call fcn.140005ba0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbx
mov r8d, 0x16
lea rdx, str.Roblox_is_not_running_
lea rcx, [rsp + 0xa0]
call fcn.140005ba0
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova rdx, qword [rsp + 0xa0]
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x140003d4b
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140003da7
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003da2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003da2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x140003dc6
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
nop
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140003e0c
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], 0xf
mov byte [rsp + 0x110], 0
mov rdx, qword [rsp + 0x168]
cmp rdx, 0xf
jbe 0x140003e6e
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], 0xf
mov byte [rsp + 0x150], 0
mov rdx, qword [rsp + 0x188]
cmp rdx, 0xf
jbe 0x140003ed0
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ecb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ecb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], 0xf
mov byte [rsp + 0x170], 0
mov rdx, qword [rsp + 0x148]
cmp rdx, 0xf
jbe 0x140003f32
inc rdx
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0x148], 0xf
mov byte [rsp + 0x130], 0
jmp 0x140003c1e
lea rax, [rsp + 0x130]
cmp qword [rsp + 0x148], 0xf
cmova rax, qword [rsp + 0x130]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x68], rax
call fcn.14000970c
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140001c40
nop
lea rcx, [rsp + 0x80]
call fcn.140002a70
movzx edi, al
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140003fff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ffa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ffa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
test dil, dil
jne 0x140004011
lea rcx, [rsp + 0x130]
call fcn.140002fd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8d, 0xa
lea rdx, str.AnonymeAPI
lea rcx, [rsp + 0x60]
call fcn.140005ba0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbx
mov r8d, 0x40
lea rdx, str.Solara_will_now_open._Press_OK_after_pressing_the_inject_button_
lea rcx, [rsp + 0xa0]
call fcn.140005ba0
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova rdx, qword [rsp + 0xa0]
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x1400040ed
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140004149
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004144
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004144
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
lea rcx, [rsp + 0x80]
call fcn.140002e50
nop
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x140004164
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
call fcn.14000970c
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rsp + 0xa0]
call fcn.140009500
nop
mov r8d, 9
lea rdx, str._Injector
lea rcx, [rsp + 0xa0]
call fcn.140007800
movups xmm7, xmmword [rax]
movups xmmword [rsp + 0x200], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rsp + 0x210], xmm6
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x14000421d
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004218
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004218
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140004284
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000427f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000427f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], bx
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
movq r15, xmm6
sub rax, r15
cmp rax, 0x17
jb 0x140004ce0
lea rax, [rsp + 0x200]
psrldq xmm6, 8
movq rcx, xmm6
mov qword [rsp + 0x60], rcx
cmp rcx, 0xf
seta byte [rsp + 0x50]
movq r12, xmm7
cmova rax, r12
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
lea r13, [r15 + 0x17]
mov edi, 0xf
lea rsi, [rsp + 0xc0]
cmp r13, rdi
jbe 0x1400043aa
mov rdi, r13
or rdi, 0xf
cmp rdi, rdx
jbe 0x14000435f
mov rdi, rdx
add r14, 0x27
mov rcx, r14
call fcn.14000a0f0
test rax, rax
je 0x140004b17
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rax, qword [rsp + 0xe0]
jmp 0x1400043a2
cmp rdi, 0x16
mov ecx, 0x16
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140004388
lea r14, [rcx + 0x27]
cmp r14, rcx
jbe 0x140004ce5
jmp 0x140004338
test rcx, rcx
je 0x14000439f
call fcn.14000a0f0
mov rsi, rax
mov rax, qword [rsp + 0xe0]
jmp 0x1400043a2
mov rsi, rbx
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xd8], rdi
mov r8, r15
mov rdx, rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str._SolaraBootstrapper.exe]
movups xmmword [r15 + rsi], xmm0
mov eax, dword [0x14000cab8]
mov dword [r15 + rsi + 0x10], eax
movzx eax, word [0x14000cabc]
mov word [r15 + rsi + 0x14], ax
movzx eax, byte [0x14000cabe]
mov byte [r15 + rsi + 0x16], al
mov byte [rsi + r13], 0
lea rax, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 0xf
cmova rax, qword [rsp + 0xc0]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xe8], rax
call fcn.14000970c
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0xe0], xmm0
lea r8, [rsp + 0xe0]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140001c40
nop
lea rcx, [rsp + 0x80]
call fcn.140002a70
movzx edi, al
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x1400044b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
test dil, dil
je 0x1400045d4
mov dword [rsp + 0x190], 0x68
xorps xmm0, xmm0
movups xmmword [rsp + 0x198], xmm0
movups xmmword [rsp + 0x1a8], xmm0
movups xmmword [rsp + 0x1b8], xmm0
movups xmmword [rsp + 0x1c8], xmm0
movups xmmword [rsp + 0x1d8], xmm0
movups xmmword [rsp + 0x1e8], xmm0
lea rcx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 0xf
cmova rcx, qword [rsp + 0xc0]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x190]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140004573
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xe0]
call fcn.140001b60
movabs rcx, 0x7ffffffed5fa0dff
mov rax, qword [rsp + 0xe0]
cmp rax, rcx
je 0x1400045b5
setl cl
test cl, cl
je 0x1400045b5
movabs rcx, 0x12a05f200
add rcx, rax
mov qword [rsp + 0xe0], rcx
jmp 0x1400045c7
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0xe0]
call fcn.140008d10
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], rbx
mov r8d, 0xa
lea rdx, str.AnonymeAPI
lea rcx, [rsp + 0xe0]
call fcn.140005ba0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbx
mov r8d, 0x5a
lea rdx, str.If_you_clicked_inject_in_solara_click_OK__DONT_CLOSE_SOLARA_ANYMORE_IT_WILL_THEN_UNINEJCT
lea rcx, [rsp + 0xa0]
call fcn.140005ba0
lea r8, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 0xf
cmova r8, qword [rsp + 0xe0]
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova rdx, qword [rsp + 0xa0]
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x1400046c5
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400046c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0xf
jbe 0x140004727
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004722
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004722
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x220]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 0xf
cmova rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x220]
call fcn.140007600
mov rax, qword [rsp + 0x220]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x220], rax
mov rax, qword [rsp + 0x220]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x21c], edx
lea rcx, [rsp + 0x228]
call fcn.140007540
test rax, rax
jne 0x1400047cd
mov rax, qword [rsp + 0x220]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x220]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x190]
call fcn.140007260
nop
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x1b0]
call fcn.140007260
nop
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x1d0]
call fcn.140007260
nop
mov ecx, 0x60
call fcn.14000a0f0
movaps xmm0, xmmword [rsp + 0x190]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rsp + 0x1a0]
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x1a8], 0xf
mov byte [rsp + 0x190], 0
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], rbx
movaps xmm0, xmmword [rsp + 0x1b0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [rsp + 0x1c0]
movups xmmword [rax + 0x30], xmm1
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1c8], 0xf
mov byte [rsp + 0x1b0], 0
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], rbx
movaps xmm0, xmmword [rsp + 0x1d0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x1e0]
movups xmmword [rax + 0x50], xmm1
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1e8], 0xf
mov byte [rsp + 0x1d0], 0
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140009650]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x100], rax
test rax, rax
je 0x140004b82
lea rcx, [rsp + 0x190]
call fcn.1400056d0
cmp dword [rsp + 0x108], 0
jne 0x140004924
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
movaps xmm0, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0xe0], xmm0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x140004952
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
lea rcx, [0x1400051f0]
call fcn.14000a500
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], rbx
mov r8d, 0xa
lea rdx, str.AnonymeAPI
lea rcx, [rsp + 0xe0]
call fcn.140005ba0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbx
mov r8d, 0x16
lea rdx, str.Injected_successfully_
lea rcx, [rsp + 0xa0]
call fcn.140005ba0
lea r8, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 0xf
cmova r8, qword [rsp + 0xe0]
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova rdx, qword [rsp + 0xa0]
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x140004a5b
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004a56
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0xf
jbe 0x140004abe
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ab8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ab8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
nop
cmp dword [rsp + 0x108], 0
je 0x140004acf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
lea rcx, [rsp + 0x220]
call fcn.140005610
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0xf
jbe 0x140004b23
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], 0xf
mov byte [rsp + 0xc0], 0
cmp byte [rsp + 0x50], 0
je 0x140004b80
mov rdx, qword [rsp + 0x60]
inc rdx
mov rax, r12
cmp rdx, 0x1000
jb 0x140004b77
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.14000a520
nop
jmp 0x140004b97
mov dword [rsp + 0x108], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
xor ebx, ebx
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140004bdd
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004bd8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], 0xf
mov byte [rsp + 0x110], 0
mov rdx, qword [rsp + 0x168]
cmp rdx, 0xf
jbe 0x140004c40
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004c3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
nop
mov rdx, qword [rsp + 0x188]
cmp rdx, 0xf
jbe 0x140004c87
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004c81
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a520
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 0xf
jbe 0x140003c1e
inc rdx
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001390
int3
call fcn.1400012f0
nop
call fcn.140001390
call fcn.1400012f0
int3