Function at 0x140001290
Capabilities:
Create thread
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rbp + 0x240], rax
xor r12d, r12d
mov r8d, 0x104
lea rdx, [rbp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
lea rax, [rbp + 0x130]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x140001300
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x58]
call fcn.140002190
nop
lea rbx, [rbp - 0x58]
mov rsi, qword [rbp - 0x58]
mov r14, qword [rbp - 0x40]
cmp r14, 0x10
cmovae rbx, rsi
mov rdi, qword [rbp - 0x48]
test rdi, rdi
je 0x1400013a8
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x140004464]
lea rdx, [0x140004466]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rbp + rax + 0x30], 1
inc rcx
cmp rcx, rdx
jne 0x140001360
lea rax, [rdi - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rbx
movzx eax, byte [r8]
cmp byte [rbp + rax + 0x30], 0
jne 0x1400013a3
cmp r8, rbx
je 0x1400013a8
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax + 0x30], 0
je 0x140001390
sub r8, rbx
jmp 0x1400013af
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rbp - 0x58]
cmp r14, 0x10
cmovae rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140002190
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140001418
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001413
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001965
call fcn.1400029fc
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x48], xmm1
lea rdx, str.LoadLibrary_Injector_by_morganlewiswall_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001dd0
lea rdx, str.Please_ensure_your_DLL_and_the_injector_are_in_the_same_folder._n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001dd0
lea rdx, str.DLL_Name:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001dd0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r12
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
lea rdx, [rbp - 0x18]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140001fa0
lea rdx, str.Target_Process:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001dd0
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], 0
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140001fa0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
lea r15, [rbp + 8]
mov r14, qword [rbp + 8]
mov r13, qword [rbp + 0x20]
cmp r13, 0x10
cmovae r15, r14
movabs rsi, 0x7fffffffffffffff
mov rdi, qword [rbp + 0x18]
cmp rdi, rsi
ja 0x1400019ee
mov qword [rbp - 0x60], 0xf
cmp rdi, 0x10
jae 0x140001527
mov qword [rbp - 0x68], rdi
mov r8d, 0x10
mov rdx, r15
lea rcx, [rbp - 0x78]
call sub.VCRUNTIME140.dll_memmove
jmp 0x1400015bb
mov rbx, rdi
or rbx, 0xf
cmp rbx, rsi
jbe 0x140001562
mov rbx, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400029c0
mov rcx, rax
test rax, rax
je 0x14000158a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400015a0
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001591
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019e8
jmp 0x140001544
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000159d
call fcn.1400029c0
jmp 0x1400015a0
mov rax, r12
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rbx
lea r8, [rdi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp - 0x78]
call fcn.1400026f0
mov ebx, eax
lea rdx, str._nProcess_Found___ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001dd0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000450c]
call fcn.140001dd0
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140001626
lea rdx, str.Failed_to_get_a_handle_to_the_process__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001dd0
lea ebx, [rdi + 1]
jmp 0x1400018f8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
jne 0x140001669
lea rdx, str.Failed_VirtualAlloc__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001dd0
lea ebx, [r15 + 2]
jmp 0x1400018f8
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
mov ebx, 1
mov r8d, ebx
lea rdx, [0x140004568]
lea rcx, [rbp - 0x78]
call fcn.140002190
nop
mov r8d, ebx
lea rcx, [rbp - 0x78]
call fcn.140001b50
mov rcx, qword [rbp - 0x48]
sub rsi, rcx
mov rdx, qword [rbp - 0x68]
cmp rsi, rdx
jb 0x1400019e2
lea r9, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae r9, qword [rbp - 0x58]
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rax, qword [rbp - 0x78]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x68]
call fcn.1400025d0
nop
lea rdx, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
lea rcx, [rsp + 0x68]
call fcn.140001aa0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8d, [rbx + 3]
lea rdx, str..dll
lea rcx, [rsp + 0x40]
call fcn.140001aa0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400017b6
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
movdqa xmm0, xmmword [0x1400045a0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140001808
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001803
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001803
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x28]
inc r9
mov qword [rsp + 0x20], r12
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140001860
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r12d
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400018aa
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], bl
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400018f8
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
nop
cmp r13, 0x10
jb 0x140001933
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000192a
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000192a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400029fc
nop
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x140001972
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000196c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000196c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400019b0
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
mov eax, ebx
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400029a0
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
int3
call fcn.1400011b0
int3