Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Check if file exists
Create thread
Enumerate processes
Get file attributes
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rdi
push r15
sub rsp, 0x1a8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor edi, edi
mov r15, rdx
cmp ecx, 4
je 0x1400010b0
mov rdx, qword [rdx]
lea rcx, str._WIN64__Usage:__s__inject__eject__process.exe_.dll_n
call fcn.140001010
mov eax, 1
jmp 0x140001454
mov rdx, qword [rdx + 8]
lea r8, str.inject
mov qword [rsp + 0x1d0], rbp
mov rcx, rdi
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x198], r12
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x1c0], rbx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140001108
cmp rcx, 7
jne 0x1400010f0
mov ebx, edi
jmp 0x140001132
mov rax, rdi
lea r8, str.eject
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x14000112b
cmp rax, 6
jne 0x140001112
cmp cl, byte [r8 + rax - 1]
mov ebx, edi
setne bl
inc ebx
mov rcx, qword [r15 + 0x18]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140001145
test al, 0x10
je 0x140001155
mov rdx, qword [r15 + 0x18]
lea rcx, str._ERROR__Dll:___s__does_not_exist__n
call fcn.140001010
mov rbp, qword [r15 + 0x10]
xor edx, edx
mov ecx, 2
mov r14d, edi
xor r12b, r12b
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400011e3
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400011e3
lea rax, [rsp + 0x7c]
mov r8, rbp
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400011c3
inc rax
test ecx, ecx
jne 0x1400011b0
test edx, edx
je 0x1400011db
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400011a1
jmp 0x1400011e3
mov r14d, dword [rsp + 0x58]
mov r12b, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12b, r12b
mov r12, qword [rsp + 0x198]
jne 0x140001213
mov rdx, qword [r15 + 0x10]
lea rcx, str._ERROR__Unable_to_find___s__n
call fcn.140001010
mov eax, 3
jmp 0x140001434
mov edx, r14d
lea rcx, str._DEBUG__pid_u_n
call fcn.140001010
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, str._DEBUG__hProc0x_p_n
mov rsi, rax
call fcn.140001010
test ebx, ebx
je 0x140001266
cmp ebx, 1
je 0x140001424
mov rdx, qword [r15 + 0x10]
lea rcx, str._ERROR__Unknown_operation_type:___s__n
call fcn.140001010
jmp 0x140001424
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001410
mov rax, qword [r15 + 0x18]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x140001280
inc r8
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdx, rax
lea rcx, str._DEBUG__loc0x_p_n
mov r14, rax
call fcn.140001010
test r14, r14
jne 0x1400012d2
lea rcx, str._ERROR__Unable_to_allocate_memory_for_path__n
call fcn.140001010
mov edi, 4
jmp 0x140001429
mov r8, qword [r15 + 0x18]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [r8 + r9], dil
jne 0x1400012e0
lea rax, [rsp + 0x40]
inc r9
mov rdx, r14
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rsp + 0x40]
lea rcx, str._DEBUG__wroteBytes_zu_n
call fcn.140001010
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, 0xffffffffffffffff
je 0x14000132d
mov ebx, edi
test rax, rax
jne 0x140001332
mov ebx, 0xffffffff
lea rdx, str.LoadLibraryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rax, rax
jne 0x14000135b
lea rcx, str.An_error_is_occured_when_trying_to_get__LoadLibraryA__address._n
call fcn.140001010
mov ebx, 0xffffffff
mov rdx, rbp
lea rcx, str._DEBUG__LoadLibraryA_address_at_0x_p_n
call fcn.140001010
mov qword [rsp + 0x30], rdi
mov r9, rbp
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdx, rax
lea rcx, str._DEBUG__hThread0x_p_n
mov rbp, rax
call fcn.140001010
cmp rbp, 0xffffffffffffffff
jne 0x1400013d7
lea rcx, str._ERROR__Unable_to_open_handle_to_thread_and_call_LoadLibrary_n
call fcn.140001010
mov edx, 0xffffffff
mov rcx, rbp
mov edi, 5
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140001429
mov edx, 0xffffffff
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edi, ebx
test ebx, ebx
jne 0x140001429
test rbp, rbp
je 0x140001429
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001429
mov edx, r14d
lea rcx, str._ERROR__Unable_to_open_process_with_pid___u__n
call fcn.140001010
mov edi, 5
test rsi, rsi
je 0x140001432
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rbx, qword [rsp + 0x1c0]
mov rbp, qword [rsp + 0x1d0]
mov rsi, qword [rsp + 0x1a0]
mov r14, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140001480
add rsp, 0x1a8
pop r15
pop rdi
ret