Function at 0x1400011c0
Capabilities:
Create thread
Enumerate processes
Get common file path
Inject dll
Inject thread
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x410], rax
xor r15d, r15d
mov r8d, 0x104
lea rdx, [rbp + 0x300]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x300]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [0x140003450]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rbp + 0x300]
mov r14, 0xffffffffffffffff
mov rbx, r14
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140001250
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x1400016d7
cmp rbx, 0xf
ja 0x14000129e
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
mov r8, rbx
lea rdx, [rbp + 0x300]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x40], r15b
jmp 0x14000133c
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x1400012d3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001b70
test rax, rax
je 0x1400012fe
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001317
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001305
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400016dd
jmp 0x1400012b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001314
call fcn.140001b70
mov rsi, rax
jmp 0x140001317
mov rsi, r15
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov r8, rbx
lea rdx, [rbp + 0x300]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r15b
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x14000138d
lea rax, [rcx + 9]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x40]
add rbx, rcx
mov r8d, 9
lea rdx, str.game.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 9], 0
lea rax, [rsp + 0x40]
jmp 0x1400013a5
mov qword [rsp + 0x20], 9
mov edx, 9
lea rcx, [rsp + 0x40]
call fcn.140001940
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001416
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001411
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001411
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001bac
movdqa xmm0, xmmword [0x1400034e0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001750
mov rcx, rax
lea rdx, [0x140001900]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdi, [0x140003468]
nop dword [rax]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0xc0], 0x238
lea rdx, [rbp + 0xc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001696
lea rdx, [rbp + 0xec]
mov rax, r15
nop word [rax + rax]
movzx ecx, word [rdx + rax*2]
cmp cx, word [rdi + rax*2]
jne 0x14000167e
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rdi + rax*2 + 2]
jne 0x14000167e
add rax, 2
cmp rax, 0x10
jne 0x140001490
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x70], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
test rax, rax
je 0x140001515
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140001515
nop dword [rax]
lea rdx, str.helldivers2.exe
lea rcx, [rbp - 0x44]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140001515
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400014f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
mov r8, r14
inc r8
cmp byte [rcx + r8], 0
jne 0x140001545
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
lea r10, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova r10, qword [rsp + 0x68]
lea r8, [rsp + 0x68]
cmova r8, qword [rsp + 0x68]
mov r9, r14
nop dword [rax]
inc r9
cmp byte [r10 + r9], 0
jne 0x140001590
inc r9
mov qword [rsp + 0x20], r15
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
nop dword [rax]
lea r14, [r14 + 1]
cmp byte [rcx + r14], 0
jne 0x140001610
lea r8, [r14 + 1]
mov r9d, 0x8000
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400016a9
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rbp + 0xc0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001480
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001450
call fcn.140001bac
xor eax, eax
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140001b50
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3