Function at 0x14001159b
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
jmp 0x140016a50
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xc98
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x22a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xcb8]
mov rax, qword [0x14002a040]
xor rax, rbp
mov qword [rbp + 0xc58], rax
lea rcx, [0x140031026]
call fcn.1400117ee
nop
mov rcx, qword [rbp + 0xc88]
call fcn.14001143d
nop
mov r8d, dword [rbp + 0xc80]
xor edx, edx
mov ecx, 0x838
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140011820
nop
lea rcx, [rbp + 8]
call fcn.140011753
test rax, rax
jne 0x140016b30
lea rdx, str.Failed_to_open_target_process
lea rcx, [rbp + 0x958]
call fcn.140011384
nop
lea rcx, [rbp + 0x958]
call fcn.140011613
nop
lea rcx, [rbp + 0x958]
call fcn.140011186
nop
mov byte [rbp + 0x994], 0
lea rcx, [rbp + 8]
call fcn.140011235
nop
mov rcx, qword [rbp + 0xc88]
call fcn.140011712
movzx eax, byte [rbp + 0x994]
jmp 0x140016fc4
mov rcx, qword [rbp + 0xc88]
call fcn.14001116d
lea rax, [rax + rax + 2]
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 8]
call fcn.140011753
mov rdx, qword [rbp + 0x28]
mov rcx, rax
call fcn.1400117c6
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x140016b8e
mov byte [rbp + 0x9b4], 0
lea rcx, [rbp + 8]
call fcn.140011235
nop
mov rcx, qword [rbp + 0xc88]
call fcn.140011712
movzx eax, byte [rbp + 0x9b4]
jmp 0x140016fc4
mov rcx, qword [rbp + 0xc88]
call fcn.1400112ad
mov qword [rbp + 0xc48], rax
lea rcx, [rbp + 8]
call fcn.140011753
mov qword [rbp + 0xc50], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x28]
mov r8, qword [rbp + 0xc48]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0xc50]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140016c31
lea rdx, str.Failed_to_write_DLL_path_to_target_process_memory
lea rcx, [rbp + 0x9d8]
call fcn.140011384
nop
lea rcx, [rbp + 0x9d8]
call fcn.140011613
nop
lea rcx, [rbp + 0x9d8]
call fcn.140011186
nop
mov byte [rbp + 0xa14], 0
lea rcx, [rbp + 8]
call fcn.140011235
nop
mov rcx, qword [rbp + 0xc88]
call fcn.140011712
movzx eax, byte [rbp + 0xa14]
jmp 0x140016fc4
mov ecx, dword [rbp + 0xc80]
call fcn.140011280
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.140011820
nop
lea rcx, [rbp + 0x68]
call fcn.140011753
test rax, rax
jne 0x140016c8a
mov byte [rbp + 0xa34], 0
lea rcx, [rbp + 0x68]
call fcn.140011235
nop
lea rcx, [rbp + 8]
call fcn.140011235
nop
mov rcx, qword [rbp + 0xc88]
call fcn.140011712
movzx eax, byte [rbp + 0xa34]
jmp 0x140016fc4
lea rcx, [rbp + 0x68]
call fcn.140011753
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x140016d02
lea rdx, str.Failed_to_suspend_the_thread
lea rcx, [rbp + 0xa58]
call fcn.140011384
nop
lea rcx, [rbp + 0xa58]
call fcn.140011613
nop
lea rcx, [rbp + 0xa58]
call fcn.140011186
nop
mov byte [rbp + 0xa94], 0
lea rcx, [rbp + 0x68]
call fcn.140011235
nop
lea rcx, [rbp + 8]
call fcn.140011235
nop
mov rcx, qword [rbp + 0xc88]
call fcn.140011712
movzx eax, byte [rbp + 0xa94]
jmp 0x140016fc4
lea rax, [rbp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rbp + 0xc0], 0x10000b
lea rcx, [rbp + 0x68]
call fcn.140011753
lea rdx, [rbp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x140016db0
lea rdx, str.Failed_to_get_thread_context
lea rcx, [rbp + 0xab8]
call fcn.140011384
nop
lea rcx, [rbp + 0xab8]
call fcn.140011613
nop
lea rcx, [rbp + 0xab8]
call fcn.140011186
nop
lea rcx, [rbp + 0x68]
call fcn.140011753
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov byte [rbp + 0xaf4], 0
lea rcx, [rbp + 0x68]
call fcn.140011235
nop
lea rcx, [rbp + 8]
call fcn.140011235
nop
mov rcx, qword [rbp + 0xc88]
call fcn.140011712
movzx eax, byte [rbp + 0xaf4]
jmp 0x140016fc4
lea rdx, str.LoadLibraryW
lea rcx, str.kernel32.dll
call fcn.14001126c
mov qword [rbp + 0x578], rax
cmp qword [rbp + 0x578], 0
jne 0x140016e48
lea rdx, str.Failed_to_resolve_LoadLibraryW
lea rcx, [rbp + 0xb18]
call fcn.140011384
nop
lea rcx, [rbp + 0xb18]
call fcn.140011613
nop
lea rcx, [rbp + 0xb18]
call fcn.140011186
nop
lea rcx, [rbp + 0x68]
call fcn.140011753
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov byte [rbp + 0xb54], 0
lea rcx, [rbp + 0x68]
call fcn.140011235
nop
lea rcx, [rbp + 8]
call fcn.140011235
nop
mov rcx, qword [rbp + 0xc88]
call fcn.140011712
movzx eax, byte [rbp + 0xb54]
jmp 0x140016fc4
mov rax, qword [rbp + 0x578]
mov qword [rbp + 0x188], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x110], rax
lea rcx, [rbp + 0x68]
call fcn.140011753
lea rdx, [rbp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x140016ef2
lea rdx, str.Failed_to_set_thread_context
lea rcx, [rbp + 0xb78]
call fcn.140011384
nop
lea rcx, [rbp + 0xb78]
call fcn.140011613
nop
lea rcx, [rbp + 0xb78]
call fcn.140011186
nop
lea rcx, [rbp + 0x68]
call fcn.140011753
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov byte [rbp + 0xbb4], 0
lea rcx, [rbp + 0x68]
call fcn.140011235
nop
lea rcx, [rbp + 8]
call fcn.140011235
nop
mov rcx, qword [rbp + 0xc88]
call fcn.140011712
movzx eax, byte [rbp + 0xbb4]
jmp 0x140016fc4
lea rcx, [rbp + 0x68]
call fcn.140011753
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140016f67
lea rdx, str.Failed_to_resume_the_thread
lea rcx, [rbp + 0xbd8]
call fcn.140011384
nop
lea rcx, [rbp + 0xbd8]
call fcn.140011613
nop
lea rcx, [rbp + 0xbd8]
call fcn.140011186
nop
mov byte [rbp + 0xc14], 0
lea rcx, [rbp + 0x68]
call fcn.140011235
nop
lea rcx, [rbp + 8]
call fcn.140011235
nop
mov rcx, qword [rbp + 0xc88]
call fcn.140011712
movzx eax, byte [rbp + 0xc14]
jmp 0x140016fc4
lea rdx, str._SUCCESS__DLL_successfully_injected_and_executed_via_thread_hijacking
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110dc
mov qword [rbp + 0xc48], rax
lea rdx, [0x14001105a]
mov rcx, qword [rbp + 0xc48]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov byte [rbp + 0xc34], 1
lea rcx, [rbp + 0x68]
call fcn.140011235
nop
lea rcx, [rbp + 8]
call fcn.140011235
nop
mov rcx, qword [rbp + 0xc88]
call fcn.140011712
movzx eax, byte [rbp + 0xc34]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400242d0]
call fcn.1400116bd
mov rax, rdi
mov rcx, qword [rbp + 0xc58]
xor rcx, rbp
call fcn.1400113de
lea rsp, [rbp + 0xc68]
pop rdi
pop rbp
ret