Function at 0x140002230
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rbp + 0x608], rax
xor eax, eax
mov qword [rsp + 0x48], r8
mov r15, r8
mov qword [rsp + 0x38], rdx
mov r12, rdx
mov qword [rbp - 0x80], rax
mov r14, rcx
mov qword [rbp - 0x78], rax
xor edi, edi
mov qword [rbp - 0x70], rax
xor edx, edx
mov qword [rbp - 0x68], rax
mov r8d, 0x108
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x58], rax
mov ebx, edi
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov r13, r9
call fcn.140004c80
xor eax, eax
cmp dword [0x140023d24], eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
jne 0x1400022f9
lea rcx, [0x140023d20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x140023d24], ebx
jne 0x1400022f9
lea rcx, str.InjectDllViaIAT:_Failed_to_obtain_system_page_size
call fcn.140001320
xor eax, eax
jmp 0x140002bff
mov qword [rsp + 0x718], rsi
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp byte [r15 + rsi], bl
jne 0x140002310
add rsi, 1
jne 0x140002332
lea rcx, str.InjectDllViaIAT:_Dll_argument_bad._n
call fcn.1400011f0
xor eax, eax
jmp 0x140002bf7
mov r15, qword [r13 + 0x10]
lea r8, [rsp + 0x50]
mov rdx, r15
mov r9d, 0x30
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
jne 0x140002363
lea rcx, str.InjectDllViaIAT:_Failed_to_query_target_process_image_base._n
call fcn.1400011f0
jmp 0x140002bf5
mov r9d, 0x40
mov qword [rsp + 0x20], rdi
lea r8, [rbp - 0x80]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140002bdd
nop word [rax + rax]
movsxd rax, dword [rbp - 0x44]
test eax, eax
je 0x140002bcf
lea rdx, [r15 + rax]
mov qword [rsp + 0x20], rdi
mov r9d, 0x108
lea r8, [rbp - 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140002bb8
cmp dword [rbp - 0x40], 0x4550
jne 0x140002baa
movzx eax, word [rbp - 0x28]
mov ecx, 0x10b
sub ax, cx
mov ecx, 0xfeff
test cx, ax
jne 0x140002baa
cmp word [rbp - 0x3c], di
je 0x140002baa
cmp dword [rbp + 0xb8], edi
jne 0x140002b8c
mov dword [rbp + 0x100], 0x10001f
test ebx, ebx
jne 0x140002423
lea rdx, [rbp + 0xd0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400024ae
mov r12, qword [rbp + 0x150]
test ebx, ebx
jne 0x1400024e4
mov ebx, dword [rbp - 0x18]
add rbx, r15
cmp r12, rbx
je 0x1400024e4
cmp qword [r13 + 0x18], rdi
jne 0x1400024d3
mov r9d, 0x30
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x1400024bf
mov r15, qword [rsp + 0x58]
lea rcx, str.InjectDllViaIAT:_Modified_EP_detected__rebasing_IAT_patch_to_new_image_base_0x_p__context_EP_0x_p__n
mov rdx, r15
mov r8, r12
call fcn.1400011f0
mov ebx, 1
mov qword [rsp + 0x20], rdi
lea r8, [rbp - 0x80]
mov rdx, r15
mov rcx, r14
lea r9d, [rbx + 0x3f]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140002bdd
mov r12, qword [rsp + 0x38]
jmp 0x140002390
lea rcx, str.InjectDllViaIAT:_GetThreadContext_failed
call fcn.1400011f0
jmp 0x140002bf5
mov rdx, rbx
lea rcx, str.InjectDllViaIAT:_Modified_EP_detected__failed_to_query_target_process_address_0x_p._n
call fcn.1400011f0
jmp 0x140002bf5
lea rcx, str.InjectDllViaIAT:_Not_a_new_process__falling_back_to_thread_injection_n
call fcn.1400011f0
jmp 0x140002bf5
mov eax, dword [rbp + 0x50]
mov r12d, 0x14
test eax, eax
je 0x140002553
lea rbx, [r15 + rax]
mov dword [rbp + 0x54], edi
mov rdx, rbx
mov qword [rsp + 0x20], rdi
mov r9d, r12d
lea r8, [rbp + 0x5b8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140002553
nop word [rax + rax]
mov eax, dword [rbp + 0x54]
add eax, r12d
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x5c4], edi
je 0x140002556
add rbx, r12
mov qword [rsp + 0x20], rdi
mov rdx, rbx
lea r8, [rbp + 0x5b8]
mov r9, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140002520
mov eax, dword [rbp + 0x54]
mov ecx, eax
movabs rax, 0xcccccccccccccccd
mul rcx
mov r13, rdx
mov edx, 1
shr r13, 4
lea eax, [r13*4]
add eax, r13d
lea ecx, [rax*4]
lea eax, [rcx + 0x14]
test al, 7
mov eax, 0x1c
cmove eax, r12d
and esi, 0xfffffffc
add eax, ecx
mov dword [rsp + 0x40], eax
add eax, 0x24
add eax, esi
mov dword [rsp + 0x30], eax
add eax, 0x108
mov r12d, eax
mov ecx, eax
mov qword [rbp + 0x5b0], r12
call fcn.1400058c8
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400025d4
lea rcx, str.InjectDllViaIAT:_Failed_to_allocate_memory_for_new_import_directory._n
call fcn.1400011f0
jmp 0x140002bf5
mov edx, dword [rbp - 0x44]
xor eax, eax
movzx ecx, word [rbp - 0x2c]
add edx, 0x18
add edx, ecx
mov qword [rbp + 0x5c0], rax
mov ebx, edi
mov qword [rbp + 0x5c8], rax
cmp di, word [rbp - 0x3a]
jae 0x1400026d1
mov r12d, edx
nop
xor eax, eax
lea r8, [rbp + 0x5e0]
mov qword [rbp + 0x5e0], rax
mov r9d, 0x28
mov qword [rbp + 0x5e8], rax
mov qword [rbp + 0x5f0], rax
mov qword [rbp + 0x5f8], rax
mov qword [rbp + 0x600], rax
mov eax, ebx
lea rcx, [rax + rax*4]
lea rsi, [r12 + rcx*8]
mov rcx, r14
lea rax, [rbp + 0x5a8]
add rsi, r15
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400026af
cmp qword [rbp + 0x5a8], 0x28
jb 0x1400026af
mov edx, dword [rbp + 0x50]
mov ecx, dword [rbp + 0x5ec]
cmp edx, ecx
jb 0x140002698
add ecx, dword [rbp + 0x5f0]
cmp edx, ecx
jae 0x140002698
movups xmm0, xmmword [rbp + 0x5e0]
movups xmm1, xmmword [rbp + 0x5f0]
movups xmmword [rbp + 0x5b8], xmm0
movups xmmword [rbp + 0x5c8], xmm1
movzx eax, word [rbp - 0x3a]
inc ebx
cmp ebx, eax
jb 0x140002600
mov r12, qword [rbp + 0x5b0]
jmp 0x1400026d4
lea eax, [rbx + 1]
mov rdx, rsi
lea rax, [rax + rax*4]
lea r8, [r12 + rax*8]
add r8, r15
lea rcx, str.InjectDllViaIAT:_Failed_to_read_section_header_from_0x_p___0x_p
call fcn.140001320
jmp 0x140002bf5
mov edx, dword [rbp + 0x50]
cmp dword [rbp + 0x5c4], edi
jne 0x140002749
mov eax, dword [rbp + 0x54]
lea r8, [rbp + 0x5b0]
add rax, r15
mov ebx, edx
add rbx, rax
mov r9d, 4
lea rax, [rbp + 0x5a8]
mov rdx, rbx
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140002737
cmp qword [rbp + 0x5a8], 4
jb 0x140002737
cmp dword [rbp + 0x5b0], 0x4550
jne 0x140002746
lea rcx, str.InjectDllViaIAT:_This_image_has_already_been_patched._n
call fcn.1400011f0
jmp 0x140002bf0
mov rdx, rbx
lea rcx, str.InjectDllViaIAT:_Failed_to_check_for_PE_header_after_existing_import_table_at_0x_p
call fcn.140001320
mov edx, dword [rbp + 0x50]
test edx, edx
je 0x1400027b8
mov eax, r13d
add rdx, r15
mov r13, qword [rsp + 0x38]
mov rcx, r14
lea rbx, [rax + rax*4]
lea rax, [rbp + 0x5a8]
shl rbx, 2
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, [r13 + 0x14]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400027aa
cmp qword [rbp + 0x5a8], rbx
jb 0x1400027aa
mov rdx, rbx
lea rcx, [r13 + 0x14]
call fcn.1400014d0
test eax, eax
jne 0x1400027bd
lea rcx, str.InjectDllViaIAT:_Blank_import_descriptor__aborting_IAT_patch._n
call fcn.1400011f0
jmp 0x140002bf0
lea rcx, str.InjectDllViaIAT:_Failed_to_read_import_descriptors._n
call fcn.1400011f0
jmp 0x1400027bd
mov r13, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
lea rax, [rbp - 0x40]
add rcx, r13
mov edx, 2
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x1400027d0
mov rax, qword [rax]
lea r9d, [rdx + 0x30]
mov qword [rcx], rax
lea r8, [rsp + 0x50]
mov eax, dword [rbp - 0x20]
mov rsi, rdi
mov ecx, dword [rbp - 0x1c]
mov ebx, dword [rbp - 0x14]
add rcx, rax
mov eax, dword [rbp - 0x24]
add rax, r15
add rax, rcx
mov rcx, r14
add rbx, rax
xor eax, eax
mov rdx, rbx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x140002988
mov r9, qword [rsp + 0x68]
mov rax, r9
and eax, 0xfff
cmp rax, 0xfff
je 0x1400029a2
cmp dword [rsp + 0x70], 0x10000
mov r8, qword [rsp + 0x50]
jne 0x140002946
mov eax, dword [0x140023d24]
lea rbx, [r15 + 0x10000000]
mov rdx, r9
sub rdx, rax
add rdx, r8
mov rax, rdx
sub rax, r15
cmp rax, 0x10000000
lea rax, [r8 + 0xffff]
cmovle rbx, rdx
and rax, 0xffffffffffff0000
cmp rbx, rax
jbe 0x140002941
nop word [rax + rax]
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
mov r8, r12
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x1400029b8
mov ecx, dword [0x140023d24]
mov r8, qword [rsp + 0x50]
sub rbx, rcx
lea rcx, [r8 + 0xffff]
and rcx, 0xffffffffffff0000
cmp rbx, rcx
ja 0x1400028f0
mov r9, qword [rsp + 0x68]
jmp 0x140002946
test rsi, rsi
jne 0x1400029b8
xor eax, eax
lea rbx, [r9 + r8]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rdx, rbx
mov qword [rsp + 0x58], rax
mov rcx, r14
mov qword [rsp + 0x60], rax
lea r9d, [rax + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
jne 0x140002882
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x1400029a2
mov rdx, rbx
lea rcx, str.InjectDllViaIAT:_Failed_to_query_target_process_memory_at_address_0x_p
call fcn.140001320
test rsi, rsi
jne 0x1400029b8
lea rcx, str.InjectDllViaIAT:_Failed_to_allocate_region_in_target_process_for_new_import_table._n
call fcn.1400011f0
jmp 0x140002bf5
mov eax, dword [rsp + 0x30]
mov ebx, esi
mov r11d, dword [rsp + 0x40]
sub ebx, r15d
mov r8d, 0x7ffffffe
mov ecx, edi
mov r9d, 0x80070057
lea r10d, [r11 + 0x20]
sub eax, r10d
mov edx, eax
dec rax
cmp rax, r8
cmova ecx, r9d
test ecx, ecx
js 0x140002a36
mov ecx, r10d
add rcx, r13
test rdx, rdx
je 0x140002a1e
mov r9, qword [rsp + 0x48]
sub r8, rdx
sub r9, rcx
lea rax, [rdx + r8]
test rax, rax
je 0x140002a1e
movzx eax, byte [rcx + r9]
test al, al
je 0x140002a1e
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140002a01
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov ecx, 0x8007007a
cmovne ecx, edi
test ecx, ecx
mov byte [rax], dil
je 0x140002a49
lea rcx, str.InjectDllViaIAT:_Failed_to_copy_DLL_path_to_new_import_directory
call fcn.140001320
jmp 0x140002bf5
lea eax, [r11 + rbx]
mov qword [rsp + 0x20], rdi
mov dword [r13], eax
movabs rcx, 0x8000000000000001
add eax, 0x10
mov r9, r12
mov dword [r13 + 0x10], eax
mov r8, r13
lea eax, [rbx + r10]
mov rdx, rsi
mov dword [r13 + 0xc], eax
mov qword [r11 + r13], rcx
mov qword [r11 + r13 + 0x10], rcx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140002a9f
lea rcx, str.InjectDllViaIAT:_Failed_to_write_new_import_descriptor_table_to_target_process
call fcn.140001320
jmp 0x140002bf5
cmp dword [rbp + 0xa8], edi
jne 0x140002aca
mov eax, dword [rbp + 0x5c4]
mov ecx, dword [rbp + 0x5c8]
mov dword [rbp + 0xa8], eax
mov eax, dword [rbp + 0x5c0]
test eax, eax
cmovne ecx, eax
mov dword [rbp + 0xac], ecx
mov eax, dword [rsp + 0x30]
mov r9d, 0x40
mov r8d, dword [rbp + 0x14]
mov rdx, r15
mov dword [rbp + 0x54], eax
mov rcx, r14
lea rax, [rbp + 0x5a0]
mov dword [rbp + 0x50], ebx
mov qword [rsp + 0x20], rax
mov qword [rbp + 0xa0], rdi
mov dword [rbp + 0x18], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140002b15
lea rcx, str.InjectDllViaIAT:_Failed_to_modify_memory_page_protection_of_NtHeader
call fcn.140001320
jmp 0x140002bf5
movsxd rdx, dword [rbp - 0x44]
lea r8, [rbp - 0x40]
add rdx, r15
mov qword [rsp + 0x20], rdi
mov r9d, 0x108
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140002b49
lea rcx, str.InjectDllViaIAT:_Failed_to_write_new_NtHeader
call fcn.140001320
jmp 0x140002bf5
mov r8d, dword [rbp + 0x14]
lea rax, [rbp + 0x5a0]
mov r9d, dword [rbp + 0x5a0]
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140002b7e
lea rcx, str.InjectDllViaIAT:_Failed_to_restore_previous_memory_page_protection
call fcn.140001320
jmp 0x140002bf5
lea rcx, str.InjectDllViaIAT:_Successfully_patched_IAT._n
call fcn.1400011f0
jmp 0x140002bf0
lea rcx, str.InjectDllViaIAT:_Executable_is_.NET__injecting_via_queued_APC._n
call fcn.1400011f0
mov r8, qword [rsp + 0x48]
mov rdx, r12
mov rcx, r14
call fcn.140001840
jmp 0x140002bf7
lea rcx, str.InjectDllViaIAT:_Executable_image_invalid._n
call fcn.1400011f0
jmp 0x140002bf0
movsxd rdx, dword [rbp - 0x44]
lea rcx, str.InjectDllViaIAT:_Failed_to_read_NT_headers_from_0x_p___0x_p
add rdx, r15
lea r8, [rdx + 0x108]
jmp 0x140002beb
lea rcx, str.InjectDllViaIAT:_Executable_DOS_header_zero._n
call fcn.1400011f0
jmp 0x140002bf0
lea r8, [r15 + 0x40]
mov rdx, r15
lea rcx, str.InjectDllViaIAT:_Failed_to_read_DOS_header_from_0x_p___0x_p
call fcn.140001320
mov edi, 1
mov eax, edi
mov rsi, qword [rsp + 0x718]
mov rcx, qword [rbp + 0x608]
xor rcx, rsp
call fcn.140003c30
add rsp, 0x720
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret