Function at 0x14001f240
Capabilities:
Create thread
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x1400506c0]
xor rax, rsp
mov qword [rbp + 0x360], rax
xor r14d, r14d
mov r12d, r14d
mov dword [rsp + 0x44], r14d
call fcn.140009640
mov rcx, rax
call fcn.140009700
call fcn.14001eb20
mov rcx, rax
call fcn.1400158e0
lea rbx, [0x140050308]
mov rcx, rbx
call fcn.140020660
lea rsi, [0x14003fcf0]
lea edi, [r14 + 0xa]
test al, al
je 0x14001f307
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, edi
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Loaded_settings.
call fcn.140006ce0
nop
lea rcx, [rbp - 0x20]
call fcn.14002ddf0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r14
mov edx, 7
mov qword [rbp - 0x50], rdx
mov word [rbp - 0x68], r14w
mov rcx, qword [0x140052478]
lea r13, [rcx + 0x10]
mov qword [rsp + 0x48], r13
cmp qword [rcx + 0x28], 0xf
jbe 0x14001f342
mov r13, qword [rcx + 0x10]
mov qword [rsp + 0x48], r13
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x70], rax
cmp dword [rcx + 8], 0
jne 0x14001f3e1
lea rax, [rcx + 0x30]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14001f367
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x48]
call fcn.140004a10
mov r12d, 1
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x14001f3cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f3c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001f3c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140038490
vmovups ymm0, ymmword [rbp - 0x48]
vmovups ymmword [rbp - 0x68], ymm0
vextractf128 xmm0, ymm0, 1
vpextrq rdx, xmm0, 1
lea rcx, [rbp - 0x68]
cmp rdx, 7
cmova rcx, qword [rbp - 0x68]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp - 0x48]
vzeroupper
call fcn.140037d6c
mov ecx, eax
test eax, eax
jne 0x14001f44f
mov edx, dword [rbp - 0x38]
test dl, 1
mov eax, 0x1ff
mov r8d, 0x16d
cmovne eax, r8d
mov dword [rsp + 0x54], eax
bt edx, 0xa
jae 0x14001f441
mov eax, dword [rbp - 0x34]
cmp eax, 0xa000000c
jne 0x14001f43a
lea edi, [rcx + 4]
jmp 0x14001f473
cmp eax, 0xa0000003
je 0x14001f473
movzx edi, dl
and edi, 0x10
or edi, 0x20
shr edi, 4
jmp 0x14001f473
mov dword [rsp + 0x54], 0xffff
sub eax, 2
je 0x14001f46e
sub eax, 1
je 0x14001f46e
sub eax, 0x32
je 0x14001f46e
cmp eax, 0x46
mov edi, r14d
jne 0x14001f473
mov edi, 1
mov dword [rsp + 0x50], ecx
lea rax, [0x140050010]
mov qword [rsp + 0x58], rax
vmovups xmm0, xmmword [rsp + 0x50]
vmovdqa xmmword [rsp + 0x50], xmm0
test edi, edi
je 0x1400202a6
cmp edi, 1
je 0x1400202ae
lea rdi, [rbp - 0x68]
mov rbx, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x50]
cmp rsi, 7
cmova rdi, rbx
mov r15, qword [rbp - 0x58]
lea rcx, [r15 + r15]
lea rdx, [rdi + rcx]
sar rcx, 1
cmp rcx, 2
jl 0x14001f4f7
mov eax, dword [rdi]
and eax, 0xffffffdf
sub eax, 0x3a0041
cmp eax, 0x1a
jae 0x14001f4f7
cmp rcx, 3
jl 0x14001f508
movzx eax, word [rdi + 4]
cmp ax, 0x5c
je 0x14001f6b8
cmp ax, 0x2f
jne 0x14001f508
jmp 0x14001f6b8
mov rcx, rdi
call fcn.14001ecb0
cmp rdi, rax
jne 0x14001f6b8
mov dword [rsp + 0x50], r14d
lea rax, [0x140050010]
mov qword [rsp + 0x58], rax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r14w
or r12d, 0x20
mov dword [rsp + 0x44], r12d
mov eax, r14d
test r15, r15
je 0x14001f656
mov word [rsp + 0x20], r14w
mov r9d, 0x104
movzx r8d, byte [rsp + 0x40]
mov edx, r9d
lea rcx, [rsp + 0x78]
call fcn.1400050e0
movzx esi, byte [rsp + 0x40]
nop
mov r15d, dword [rbp - 0x78]
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova r8, qword [rsp + 0x78]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 7
cmova rcx, qword [rbp - 0x68]
mov edx, r15d
call fcn.140037d3c
mov rbx, rax
mov qword [rsp + 0x50], rax
mov ecx, eax
mov r8, qword [rbp - 0x78]
cmp rcx, r8
ja 0x14001f5c8
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova rax, qword [rsp + 0x78]
mov qword [rbp - 0x78], rcx
mov word [rax + rcx*2], r14w
jmp 0x14001f625
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp - 0x70]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x14001f60e
mov qword [rbp - 0x78], rcx
lea r9, [rsp + 0x78]
cmp rdi, 7
cmova r9, qword [rsp + 0x78]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14001f603
movzx eax, r14w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r14w
jmp 0x14001f625
mov word [rsp + 0x20], r14w
mov r9, rdx
movzx r8d, sil
lea rcx, [rsp + 0x78]
call fcn.1400050e0
cmp ebx, r15d
jae 0x14001f570
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x50], eax
lea rcx, [0x140050010]
mov qword [rsp + 0x58], rcx
vmovups xmm0, xmmword [rsp + 0x50]
vmovdqa xmmword [rsp + 0x50], xmm0
mov rsi, qword [rbp - 0x50]
mov rbx, qword [rbp - 0x68]
and r12d, 0xffffffdf
or r12d, 0x10
mov dword [rsp + 0x44], r12d
test eax, eax
jne 0x14002056c
cmp rsi, 7
jbe 0x14001f6a9
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001f6a1
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001f6a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140038490
vmovups ymm0, ymmword [rsp + 0x78]
vmovups ymmword [rbp - 0x68], ymm0
and r12d, 0xffffffef
lea rdi, [0x140050308]
mov rcx, rdi
vzeroupper
call fcn.140020660
lea r15, [0x14003fcf0]
test al, al
je 0x14001f84e
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
lea r9, str.main
mov r8d, 0x20
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Starting_injection_for
call fcn.140006ce0
mov rsi, rax
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 7
cmova rcx, qword [rbp - 0x68]
mov rax, qword [rbp - 0x58]
lea rbx, [rcx + rax*2]
mov rdi, rbx
mov rdx, rbx
call fcn.14001ecb0
cmp rax, rbx
je 0x14001f78b
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14001f756
cmp cx, 0x2f
jne 0x14001f75f
add rax, 2
cmp rax, rbx
jne 0x14001f747
cmp rax, rbx
je 0x14001f78b
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rdi - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14001f78b
cmp cx, 0x2f
je 0x14001f78b
mov rdi, rdx
cmp rax, rdx
jne 0x14001f770
mov qword [rsp + 0x50], rdi
sub rbx, rdi
sar rbx, 1
mov qword [rsp + 0x58], rbx
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.14001de00
or r12d, 0x40
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x78]
call fcn.14001e040
bts r12d, 7
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x38]
mov rcx, rsi
call fcn.140006f80
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x14001f822
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f81d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001f81d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140038490
vmovdqu xmm0, xmmword [0x14003feb0]
vmovdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
lea rcx, [rsp + 0x78]
call fcn.140006190
nop
lea rcx, [rbp - 0x20]
call fcn.14002ddf0
lea rdi, [0x140050308]
lea rcx, [rbp - 0x68]
call fcn.14001e8b0
cmp eax, 5
ja case.default.0x14001f873
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x205f4]
add rcx, rdx
jmp rcx
lea rbx, [0x140050330]
mov rcx, rbx
call fcn.140020660
test al, al
je 0x1400204e6
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x25
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Failed_to_access_DLL_on_disk.
call fcn.140006ce0
nop
jmp 0x1400204dd
lea rbx, [0x140050330]
mov rcx, rbx
call fcn.140020660
test al, al
je 0x1400204e6
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x29
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.DLL_file_seems_inconceivably_small__request_to_inject_ignored.
call fcn.140006ce0
nop
jmp 0x1400204dd
lea rbx, [0x140050330]
mov rcx, rbx
call fcn.140020660
test al, al
je 0x1400204e6
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x2d
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Failed_to_allocate_memory_when_checking_DLL_file.
call fcn.140006ce0
nop
jmp 0x1400204dd
lea rbx, [0x140050330]
mov rcx, rbx
call fcn.140020660
test al, al
je 0x1400204e6
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x31
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.The_file_given_does_not_appear_to_be_a_valid_DLL.
call fcn.140006ce0
nop
jmp 0x1400204dd
lea rbx, [0x140050330]
mov rcx, rbx
call fcn.140020660
test al, al
je 0x1400204e6
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x35
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.The_DLL_given_did_not_match_the_target_platform_the_injector.
call fcn.140006ce0
nop
jmp 0x1400204dd
mov rcx, rdi
call fcn.140020660
test al, al
je case.default.0x14001f873
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
lea r9, str.main
mov r8d, 0x39
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.DLL_seems_valid__proceeding_with_injection.
call fcn.140006ce0
nop
lea rcx, [rbp - 0x20]
call fcn.14002ddf0
mov rsi, 0xffffffffffffffff
mov rdi, rsi
inc rdi
cmp byte [rdi + r13], 0
jne 0x14001fac4
inc rdi
mov eax, 2
mul rdi
cmovo rax, rsi
mov rcx, rax
call fcn.1400388e0
mov r13, rax
mov r8, rdi
mov rdi, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x124]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x120], 0x238
lea rbx, [0x140050330]
cmp r15, rsi
jne 0x14001fb9e
mov rcx, rbx
call fcn.140020660
lea rsi, [0x14003fcf0]
test al, al
je 0x14001fc28
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.Injector::GetProcessId
mov r8d, 0x33
lea rdx, str.C:UsersPCCDesktopInjector_master_srcInjector.hpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.CreateToolhelp32Snapshot_returned_INVALID_HANDLE_VALUE__unable_to_proceed.
call fcn.140006ce0
nop
lea rcx, [rbp - 0x20]
call fcn.14002ddf0
jmp 0x14001fc28
mov edi, esi
lea rdx, [rbp + 0x120]
mov rcx, r15
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14001fc0b
nop dword [rax]
nop word [rax + rax]
lea rax, [rbp + 0x14c]
mov rdi, r13
sub rdi, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x14001fbe3
add rax, 2
test ecx, ecx
jne 0x14001fbd0
test edx, edx
je 0x14001fc05
lea rdx, [rbp + 0x120]
mov rcx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14001fbc0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001fc1c
mov edi, dword [rbp + 0x128]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, esi
jne 0x14001fca2
lea rsi, [0x14003fcf0]
mov rdi, qword [rsp + 0x48]
mov rcx, rbx
call fcn.140020660
test al, al
je 0x1400204e6
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x41
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Unable_to_find_target_application
call fcn.140006ce0
mov r8, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rax
call fcn.140006f80
mov rcx, rax
lea rdx, str.__is_it_running_
call fcn.140006ce0
nop
jmp 0x1400204dd
lea r13, [0x140050308]
mov rcx, r13
call fcn.140020660
lea r15, [0x14003fcf0]
test al, al
je 0x14001fd37
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r13
lea r9, str.main
mov r8d, 0x45
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Found_target_application
call fcn.140006ce0
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140006f80
lea rdx, str._with_process_id_
mov rcx, rax
call fcn.140006ce0
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
nop
lea rcx, [rbp - 0x20]
call fcn.14002ddf0
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x14001fdae
mov rcx, rbx
call fcn.140020660
test al, al
je 0x1400204e6
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r9, str.main
lea r8d, [rdi + 0x4b]
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Failed_to_open_target_with_necessary_rights_to_inject.
call fcn.140006ce0
nop
jmp 0x1400204dd
mov rax, qword [0x140052478]
cmp dword [rax + 0xc], 0
jne 0x140020232
mov rcx, r13
call fcn.140020660
test al, al
je 0x14001fe1a
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r13
lea r9, str.main
mov r8d, 0x52
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Attempting_LoadLibrary_of_DLL...
call fcn.140006ce0
nop
lea rcx, [rbp - 0x20]
call fcn.14002ddf0
lea r13, [rbp - 0x68]
cmp qword [rbp - 0x50], 7
cmova r13, qword [rbp - 0x68]
mov r15, qword [rbp - 0x58]
call fcn.140037adc
mov dword [rsp + 0x48], eax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x78], xmm0
vmovdqu xmm1, xmmword [0x14003feb0]
vmovdqu xmmword [rbp - 0x78], xmm1
mov byte [rsp + 0x78], 0
bts r12d, 0xb
mov dword [rsp + 0x44], r12d
test r15, r15
je 0x14001fed8
cmp r15, 0x7fffffff
ja 0x140020582
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, r15d
mov rdx, r13
mov ecx, eax
call fcn.140037b4c
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x14002058d
movsxd rdx, edi
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.14001b690
lea r9, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova r9, qword [rsp + 0x78]
mov dword [rsp + 0x20], edi
mov r8d, r15d
mov rdx, r13
mov ecx, dword [rsp + 0x48]
call fcn.140037b4c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140020599
mov rdi, qword [rsp + 0x70]
btr r12d, 0xb
or r12d, 0x700
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rax, qword [rsp + 0x78]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001ff00
inc r8
mov dword [rsp + 0x20], 0x10
xor edx, edx
mov r9d, 0x1000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x50], rax
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14001ff6d
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ff68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ff68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140038490
vmovdqu xmm0, xmmword [0x14003feb0]
vmovdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
test rdi, rdi
jne 0x14001ffe4
mov rcx, rbx
call fcn.140020660
test al, al
je 0x1400204e6
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
lea rsi, [0x14003fcf0]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
lea r8d, [rdi + 0x57]
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Failed_to_allocate_DLL_file_path_to_target_process.
call fcn.140006ce0
nop
jmp 0x1400204dd
lea r13, [rbp - 0x68]
cmp qword [rbp - 0x50], 7
cmova r13, qword [rbp - 0x68]
mov r15, qword [rbp - 0x58]
call fcn.140037adc
mov dword [rsp + 0x48], eax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x48], xmm0
vmovdqu xmm1, xmmword [0x14003feb0]
vmovdqu xmmword [rbp - 0x38], xmm1
mov byte [rbp - 0x48], 0
bts r12d, 0xf
mov dword [rsp + 0x44], r12d
test r15, r15
je 0x14002009d
cmp r15, 0x7fffffff
ja 0x1400205a3
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, r15d
mov rdx, r13
mov ecx, eax
call fcn.140037b4c
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x1400205ae
movsxd rdx, edi
xor r8d, r8d
lea rcx, [rbp - 0x48]
call fcn.14001b690
lea r9, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova r9, qword [rbp - 0x48]
mov dword [rsp + 0x20], edi
mov r8d, r15d
mov rdx, r13
mov ecx, dword [rsp + 0x48]
call fcn.140037b4c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400205ba
mov rdi, qword [rsp + 0x50]
lea r8, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova r8, qword [rbp - 0x48]
nop dword [rax + rax]
lea rsi, [rsi + 1]
cmp byte [r8 + rsi], 0
jne 0x1400200b0
lea r9, [rsi + 1]
mov qword [rsp + 0x20], r14
mov rdx, rdi
mov rsi, qword [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140020115
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020110
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020110
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140038490
test edi, edi
jne 0x140020179
mov rcx, rbx
call fcn.140020660
test al, al
je 0x1400204e6
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
lea rsi, [0x14003fcf0]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
lea r8d, [rdi + 0x5e]
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Failed_to_write_DLL_file_path_to_target_process.
call fcn.140006ce0
nop
jmp 0x1400204dd
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14002022b
lea rdx, str.LoadLibraryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x14002022b
mov rcx, rbx
call fcn.140020660
test al, al
je 0x1400204e6
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
lea rsi, [0x14003fcf0]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x65
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Failed_to_start_LoadLibrary_call_with_remote_thread.
call fcn.140006ce0
nop
jmp 0x1400204dd
lea r13, [0x140050308]
mov rcx, r13
call fcn.140020660
test al, al
je 0x140020294
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
lea rsi, [0x14003fcf0]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
lea r9, str.main
mov r8d, 0x6b
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Successfully_sent_instructions_to_target_process_
call fcn.140006ce0
nop
lea rcx, [rbp - 0x20]
call fcn.14002ddf0
call fcn.140009640
mov rcx, rax
call fcn.140008b90
jmp 0x1400204ec
test ecx, ecx
jne 0x1400205c4
lea rbx, [0x140050330]
mov rcx, rbx
call fcn.140020660
test al, al
je 0x1400204e6
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x16
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, str.main
mov r8d, 0x19
lea rdx, str.C:UsersPCCDesktopInjector_master_srcmain.cpp
lea rcx, [rbp - 0x20]
call fcn.14002dc20
nop
lea rcx, [rax + 8]
lea rdx, str.Unable_to_find_DLL_file_
call fcn.140006ce0
mov rdi, rax
mov qword [rsp + 0x50], rax
lea r13, [rbp - 0x68]
cmp qword [rbp - 0x50], 7
cmova r13, qword [rbp - 0x68]
mov r15, qword [rbp - 0x58]
call fcn.140037adc
mov dword [rsp + 0x48], eax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x78], xmm0
mov rcx, r14
mov qword [rbp - 0x78], rcx
mov edx, 0xf
mov qword [rbp - 0x70], rdx
mov byte [rsp + 0x78], cl
or r12d, 8
mov dword [rsp + 0x44], r12d
test r15, r15
je 0x14002044d
cmp r15, 0x7fffffff
ja 0x1400205da
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, r15d
mov rdx, r13
mov ecx, eax
call fcn.140037b4c
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400205e5
movsxd rcx, ebx
mov rdx, qword [rbp - 0x78]
cmp rcx, rdx
ja 0x1400203b4
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rax, qword [rsp + 0x78]
mov qword [rbp - 0x78], rcx
mov byte [rax + rcx], 0
jmp 0x140020413
mov rsi, rcx
sub rsi, rdx
mov rdi, qword [rbp - 0x70]
mov rax, rdi
sub rax, rdx
cmp rsi, rax
ja 0x1400203f3
mov qword [rbp - 0x78], rcx
lea rax, [rsp + 0x78]
cmp rdi, 0xf
cmova rax, qword [rsp + 0x78]
lea rdi, [rax + rdx]
mov r8, rsi
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov byte [rdi + rsi], 0
jmp 0x14002040e
mov byte [rsp + 0x20], 0
mov r9, rsi
movzx r8d, byte [rsp + 0x40]
mov rdx, rsi
lea rcx, [rsp + 0x78]
call fcn.14000dde0
mov rdi, qword [rsp + 0x50]
lea r9, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova r9, qword [rsp + 0x78]
mov dword [rsp + 0x20], ebx
mov r8d, r15d
mov rdx, r13
mov ecx, dword [rsp + 0x48]
call fcn.140037b4c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140020562
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
lea rax, [rsp + 0x78]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov word [rsp + 0x60], 0x5c22
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14001dae0
mov rdi, rax
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400204bc
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400204b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400204b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140038490
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
lea rdx, str.__make_sure_it_exists.
mov rcx, rdi
call fcn.140006ce0
nop
lea rcx, [rbp - 0x20]
call fcn.14002ddf0
mov r14d, 1
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x14002052f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002052a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002052a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140038490
mov eax, r14d
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1400387f0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rcx, 0x20
call fcn.1400060b0
nop
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x50]
lea rcx, str.absolute
call fcn.14001f1d0
nop
mov ecx, 0x16
call fcn.140006070
int3
shr rdi, 0x20
mov ecx, edi
call fcn.1400060b0
int3
shr rcx, 0x20
call fcn.1400060b0
nop
mov ecx, 0x16
call fcn.140006070
int3
shr rdi, 0x20
mov ecx, edi
call fcn.1400060b0
int3
shr rcx, 0x20
call fcn.1400060b0
nop
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x50]
lea rcx, str.exists
call fcn.14001f1d0
nop
mov ecx, 0x16
call fcn.140006070
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.1400060b0
int3