Function at 0x140011069
Capabilities:
Check if file exists
Execute command

Disassembly:
jmp 0x140020580
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x72
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140033040]
xor rax, rbp
mov qword [rbp + 0x278], rax
lea rcx, [0x14003c100]
call fcn.140011b2c
nop
lea rcx, [rbp + 8]
call fcn.1400118d4
nop
lea rcx, [rbp + 0x48]
call fcn.1400118d4
nop
lea rcx, [rbp + 0x88]
call fcn.1400118d4
nop
lea r8, [rbp + 0x88]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 8]
call fcn.140011609
movzx eax, al
test eax, eax
jne 0x14002068a
lea rdx, str.Process_name__Taskmgr.exe_:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400115d2
nop
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t___std::wcin]
call fcn.140011aa0
nop
lea rdx, str.DLL_path__Full_path_to_the_desired_DLL_:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400115d2
nop
lea rdx, [rbp + 0x48]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t___std::wcin]
call fcn.140011aa0
nop
lea rdx, str.Stellar_path__Full_path_to_Stellar_:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400115d2
nop
lea rdx, [rbp + 0x88]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t___std::wcin]
call fcn.140011aa0
nop
lea r8, [rbp + 0x88]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 8]
call fcn.140011947
nop
jmp 0x140020731
lea rdx, str.Using_saved_configuration:_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400115d2
nop
lea rdx, str.Stellar_name:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400115d2
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.140011695
lea rdx, [0x140011569]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rdx, str.DLL_path:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400115d2
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.140011695
lea rdx, [0x140011569]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rdx, str.Stellar_path:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400115d2
lea rdx, [rbp + 0x88]
mov rcx, rax
call fcn.140011695
lea rdx, [0x140011569]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [0x14002dfd4]
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, [rbp + 0x48]
call fcn.1400113b1
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400207a5
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.DLL_File_does_NOT_exist_
mov rcx, rax
call fcn.140011a19
nop
mov dword [rbp + 0x1a4], 1
lea rcx, [rbp + 0x88]
call fcn.1400119d8
nop
lea rcx, [rbp + 0x48]
call fcn.1400119d8
nop
lea rcx, [rbp + 8]
call fcn.1400119d8
mov eax, dword [rbp + 0x1a4]
jmp 0x1400209c0
lea rcx, [rbp + 0x88]
call fcn.1400113b1
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14002080e
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.Executable_File_does_NOT_exist_
mov rcx, rax
call fcn.140011a19
nop
mov dword [rbp + 0x1c4], 1
lea rcx, [rbp + 0x88]
call fcn.1400119d8
nop
lea rcx, [rbp + 0x48]
call fcn.1400119d8
nop
lea rcx, [rbp + 8]
call fcn.1400119d8
mov eax, dword [rbp + 0x1c4]
jmp 0x1400209c0
lea rcx, [rbp + 0x88]
call fcn.1400113b1
mov rcx, rax
call fcn.1400112a3
nop
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, str.Letting_Stellar_load.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400115d2
lea rdx, [0x140011569]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov dword [rbp + 0x204], 0xa
lea rdx, [rbp + 0x204]
lea rcx, [rbp + 0x1e8]
call fcn.140011285
mov rcx, rax
call fcn.1400111fe
nop
mov dword [rbp + 0xc4], 0
lea rcx, [rbp + 8]
call fcn.1400113b1
mov dx, 0xd
mov rcx, rax
call fcn.140011677
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 0
jne 0x14002091f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x274], eax
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov ecx, dword [rbp + 0x274]
mov r8d, ecx
lea rdx, str.Process_Not_found__0x_lX__n
mov rcx, rax
call fcn.140011a19
nop
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.Here_is_a_list_of_available_processes:_n
mov rcx, rax
call fcn.140011a19
nop
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x14002dfd4]
call qword [sym.imp.ucrtbased.dll_system]
nop
mov dx, 0x539
lea rcx, str.skinjbir
call fcn.140011677
nop
jmp 0x14002096a
lea rcx, [rbp + 0x48]
call fcn.1400113b1
mov rdx, rax
mov ecx, dword [rbp + 0xc4]
call fcn.1400118b6
test eax, eax
jne 0x14002096a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x274], eax
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov ecx, dword [rbp + 0x274]
mov r8d, ecx
lea rdx, str.DLL_Injection_failed__0x_lX__n
mov rcx, rax
call fcn.140011a19
nop
mov dword [rbp + 0x244], 2
lea rdx, [rbp + 0x244]
lea rcx, [rbp + 0x228]
call fcn.140011285
mov rcx, rax
call fcn.1400111fe
nop
mov dword [rbp + 0x264], 0
lea rcx, [rbp + 0x88]
call fcn.1400119d8
nop
lea rcx, [rbp + 0x48]
call fcn.1400119d8
nop
lea rcx, [rbp + 8]
call fcn.1400119d8
mov eax, dword [rbp + 0x264]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002cae0]
call fcn.14001196a
mov rax, rdi
mov rcx, qword [rbp + 0x278]
xor rcx, rbp
call fcn.14001155a
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret