Function at 0x3a4da151e
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push rbp
mov eax, 0x2190
call fcn.3a4da2770
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x2120], ecx
mov qword [rbp + 0x2128], rdx
mov r8d, dword [rbp + 0x2120]
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x2100], rax
cmp qword [rbp + 0x2100], 0
jne 0x3a4da1576
mov eax, 0
jmp 0x3a4da192e
lea rcx, str.psapi.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.EnumProcessModules
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x20f8], rax
lea rcx, str.psapi.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.GetModuleFileNameExA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x20f0], rax
cmp qword [rbp + 0x20f8], 0
je 0x3a4da16a7
cmp qword [rbp + 0x20f0], 0
je 0x3a4da16a7
lea rcx, [rbp + 0xcc]
lea rdx, [rbp + 0xd0]
mov rax, qword [rbp + 0x2100]
mov r10, qword [rbp + 0x20f8]
mov r9, rcx
mov r8d, 0x2000
mov rcx, rax
call r10
test eax, eax
je 0x3a4da16c4
mov dword [rbp + 0x210c], 0
jmp 0x3a4da1694
mov eax, dword [rbp + 0x210c]
mov rdx, qword [rbp + rax*8 + 0xd0]
lea rcx, [rbp - 0x40]
mov rax, qword [rbp + 0x2100]
mov r10, qword [rbp + 0x20f0]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call r10
test eax, eax
je 0x3a4da168d
mov rdx, qword [rbp + 0x2128]
lea rax, [rbp - 0x40]
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x3a4da168d
mov rax, qword [rbp + 0x2100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x3a4da192e
add dword [rbp + 0x210c], 1
mov eax, dword [rbp + 0xcc]
shr eax, 3
cmp dword [rbp + 0x210c], eax
jb 0x3a4da1625
jmp 0x3a4da16c4
mov rax, qword [rbp + 0x2100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x3a4da192e
mov rax, qword [rbp + 0x2128]
mov rcx, rax
call sub.msvcrt.dll_strlen
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x2100]
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x20e8], rax
cmp qword [rbp + 0x20e8], 0
jne 0x3a4da172e
mov rax, qword [rbp + 0x2100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x3a4da192e
mov rax, qword [rbp + 0x2128]
mov rcx, rax
call sub.msvcrt.dll_strlen
lea r8, [rax + 1]
mov rcx, qword [rbp + 0x2128]
mov rdx, qword [rbp + 0x20e8]
mov rax, qword [rbp + 0x2100]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
jne 0x3a4da17b8
mov rdx, qword [rbp + 0x20e8]
mov rax, qword [rbp + 0x2100]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x2100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x3a4da192e
lea rcx, str.kernel32.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.LoadLibraryA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x20e0], rax
cmp qword [rbp + 0x20e0], 0
jne 0x3a4da182f
mov rdx, qword [rbp + 0x20e8]
mov rax, qword [rbp + 0x2100]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x2100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x3a4da192e
mov rcx, qword [rbp + 0x20e0]
mov rax, qword [rbp + 0x2100]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rdx, qword [rbp + 0x20e8]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x20d8], rax
cmp qword [rbp + 0x20d8], 0
jne 0x3a4da18c5
mov rdx, qword [rbp + 0x20e8]
mov rax, qword [rbp + 0x2100]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x2100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x3a4da192e
mov rax, qword [rbp + 0x20d8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rdx, qword [rbp + 0x20e8]
mov rax, qword [rbp + 0x2100]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x20d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x2100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
add rsp, 0x2190
pop rbp
ret