Function at 0x1400019a0
Capabilities:
Create process on windows
Create thread
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov qword [rsp + 0x58], rdx
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x140004490]
movdqu xmmword [rbp + 0x50], xmm1
mov byte [rbp + 0x40], dil
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
mov ecx, 0x20
call fcn.1400023f0
mov rbx, rax
mov qword [rbp + 0x60], rax
movdqa xmm0, xmmword [0x1400044a0]
movdqu xmmword [rbp + 0x70], xmm0
movups xmm0, xmmword [str.Stalker2_Win64_Shipping.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140004420]
movsd qword [rax + 0x10], xmm0
movzx eax, word [0x140004428]
mov word [rbx + 0x18], ax
movzx eax, byte [0x14000442a]
mov byte [rbx + 0x1a], al
mov byte [rbx + 0x1b], dil
mov byte [rbp + 0xe0], dil
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0xe1]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
mov dword [rbp - 0x80], 0x98
mov qword [rbp - 0x78], rdi
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], 0x104
lea rax, [rbp + 0x40]
mov dword [rbp - 0x54], 1
mov qword [rbp - 0x40], rdi
mov dword [rbp - 0x38], edi
mov qword [rbp - 0x30], rdi
mov dword [rbp - 0x20], 0x1800
cmp qword [rbp + 0x58], 0xf
jbe 0x140001ade
mov rax, qword [rbp + 0x40]
mov qword [rbp - 0x68], rax
lea rax, [0x140004408]
mov qword [rbp - 0x18], rax
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea rcx, [rbp - 0x80]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp + 0x90], rdi
movups xmmword [rbp + 0x80], xmm0
test eax, eax
je 0x140001b6d
mov qword [rbp + 0x98], rdi
lea rax, [rbp + 0xe0]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140001b40
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x80]
call fcn.140001270
mov r14, qword [rbp + 0x90]
mov r13, qword [rbp + 0x98]
jmp 0x140001b84
mov r14, rdi
mov r13d, 0xf
mov qword [rbp + 0x98], r13
mov byte [rbp + 0x80], r14b
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140001bc2
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001bbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001bbd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000242c
movdqa xmm0, xmmword [0x140004490]
movdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140001c19
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c0c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000242c
movdqa xmm0, xmmword [0x140004490]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov rcx, qword [rbp + 0x80]
test r14, r14
je 0x140002362
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
mov dword [rbp - 0x1c], eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x80], 0x68
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
sub rax, r14
cmp rax, 1
jb 0x1400023dd
lea r12, [rbp + 0x80]
cmp r13, 0xf
cmova r12, rcx
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
lea r15, [r14 + 1]
mov edi, 0xf
lea rsi, [rbp + 0x20]
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp r15, rdi
jbe 0x140001d26
mov rdi, r15
or rdi, 0xf
cmp rdi, rdx
jbe 0x140001ce7
mov rdi, rdx
add rax, 0x27
mov rcx, rax
call fcn.1400023f0
test rax, rax
je 0x140001d13
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001d22
cmp rdi, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140001cfb
xor esi, esi
jmp 0x140001d22
cmp rcx, 0x1000
jb 0x140001d1a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400023d1
jmp 0x140001ccc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400023f0
mov rsi, rax
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rdi
mov r8, r14
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0x20
mov byte [rsi + r15], 0
mov r8d, 0x21
lea rdx, str._NoVerifyGC__ForceRunInBackground
lea rcx, [rbp + 0x20]
call fcn.1400018f0
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140001dd6
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001dd1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000242c
movdqa xmm0, xmmword [0x140004490]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0xf
cmova rdx, qword [rbp + 0xc0]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000231d
mov rdi, qword [rsp + 0x58]
mov rdx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x140001e55
lea rcx, [rbp + 0x40]
call fcn.140001270
nop
mov rdx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x140001e84
lea rcx, [rbp + 0xa0]
call fcn.140001270
nop
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rdi, qword [rbp + 0xa0]
mov rsi, qword [rbp + 0xb0]
test rsi, rsi
je 0x140001f2d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xe0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x140004454]
lea rdx, [0x140004456]
movzx eax, byte [rcx]
mov byte [rbp + rax + 0xe0], 1
inc rcx
cmp rcx, rdx
jne 0x140001ee0
lea rax, [rsi - 1]
mov r8, rbx
cmp rax, rbx
cmovb r8, rax
add r8, rdi
movzx eax, byte [r8]
cmp byte [rbp + rax + 0xe0], 0
jne 0x140001f28
cmp r8, rdi
je 0x140001f2d
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax + 0xe0], 0
je 0x140001f12
sub r8, rdi
jmp 0x140001f30
mov r8, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], r14
cmp qword [rbp + 0x50], r8
cmovb r8, qword [rbp + 0x50]
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.140001270
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140001fa4
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f9f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000242c
movdqa xmm0, xmmword [0x140004490]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140001ff9
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ff4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ff4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000242c
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r15, qword [rbp + 0x30]
sub rax, r15
cmp rax, 0xf
jb 0x1400023cb
lea rax, [rbp + 0x20]
mov r14, qword [rbp + 0x20]
mov r13, qword [rbp + 0x38]
cmp r13, 0xf
cmova rax, r14
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
lea r12, [r15 + 0xf]
mov edi, 0xf
lea rsi, [rbp + 0x60]
cmp r12, rdi
jbe 0x1400020c8
mov rdi, r12
or rdi, 0xf
cmp rdi, rcx
jbe 0x140002085
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400023f0
test rax, rax
je 0x140002140
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400020bf
cmp rdi, 0x16
mov ecx, 0x16
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x14000209f
xor esi, esi
jmp 0x1400020c4
cmp rcx, 0x1000
jb 0x1400020b7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400023d7
jmp 0x140002066
call fcn.1400023f0
mov rsi, rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], rdi
mov r8, r15
mov rdx, rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.S2MPModule.dll]
movsd qword [rsi + r15], xmm0
mov eax, dword [0x140004460]
mov dword [rsi + r15 + 8], eax
movzx eax, word [0x140004464]
mov word [rsi + r15 + 0xc], ax
movzx eax, byte [0x140004466]
mov byte [rsi + r15 + 0xe], al
mov byte [rsi + r12], 0
cmp r13, 0xf
jbe 0x14000214f
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140002147
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002147
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14000242c
movups xmm0, xmmword [rbp + 0x60]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbp + 0x70]
movups xmmword [rbp + 0x30], xmm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x60]
call fcn.140001550
mov rdi, rax
mov r8d, dword [rsp + 0x70]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140002232
cmp rax, 0xffffffffffffffff
je 0x140002229
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
cmp qword [rdi + 0x18], 0xf
jbe 0x1400021d1
mov rcx, qword [rdi]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x1400021c3
mov r8, rcx
jmp 0x1400021dd
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400021d1
mov r8, rdi
inc rbx
xor r15d, r15d
mov qword [rsp + 0x20], r15
mov r9, rbx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140002229
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140002268
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140002263
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400022cb
mov rcx, r8
call fcn.14000242c
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x1400022d7
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000242c
mov r13, qword [rbp + 0x98]
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x14000235b
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002356
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002356
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.Failed_to_start_process._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001010
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001510]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400022de
call fcn.14000242c
mov rcx, qword [rbp + 0x80]
cmp r13, 0xf
jbe 0x140002399
lea rdx, [r13 + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002394
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002394
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000242c
xor eax, eax
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140002760
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400018d0
nop
call fcn.1400018b0
nop
call fcn.1400018b0
nop
call fcn.1400018d0
int3