Function at 0x1400014d0
Capabilities:
Create thread
Inject thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov esi, ecx
lea rcx, [rbp - 0x20]
call fcn.140015d90
mov r15, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x18]
movabs rbx, 0x8000000000000000
mov r14, qword [rbp - 0x10]
cmp r15, rbx
jne 0x14000166a
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x30], rdi
mov ecx, 0x2a
xor edx, edx
mov r8d, esi
call sub.KERNEL32.dll_OpenProcess
mov rsi, rax
test rax, rax
je 0x1400016a8
mov dword [rsp + 0x20], 4
mov rcx, rsi
xor edx, edx
mov r8, qword [rbp + 0x38]
mov r9d, 0x3000
call sub.KERNEL32.dll_VirtualAllocEx
mov rdi, rax
mov qword [rbp - 0x30], rax
lea r14, [rbp - 0x30]
mov qword [rbp - 0x40], r14
lea r15, [fcn.14001a8c0]
mov qword [rbp - 0x38], r15
lea rax, str.Allocated_memory_for_the_library_path_at_0x_n
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 2
mov qword [rbp], 0
lea r12, [rbp - 0x40]
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 1
lea rcx, [rbp - 0x20]
call fcn.140006120
test rdi, rdi
je 0x1400016de
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rdi
mov r8, qword [rbp + 0x30]
mov r9, qword [rbp + 0x38]
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.kernel32.dllLoadLibraryALoadLibraryA_found_at_0x
lea rcx, [rbp - 0x20]
mov r8d, 0xc
call fcn.140015d90
mov rcx, qword [rbp - 0x20]
mov r13, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0x10], rax
cmp rcx, rbx
jne 0x140001714
mov qword [rbp + 0x18], r13
lea rdx, [0x14001e6b4]
lea rcx, [rbp - 0x20]
mov r8d, 0xc
call fcn.140015d90
mov rcx, qword [rbp - 0x20]
mov r13, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0x28], rax
cmp rcx, rbx
jne 0x140001766
mov qword [rbp + 0x20], r13
mov rcx, qword [rbp + 0x18]
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x1400017bd
mov rcx, rax
mov rdx, qword [rbp + 0x20]
call sub.KERNEL32.dll_GetProcAddress
mov rbx, rax
test rax, rax
je 0x1400018e8
xor eax, eax
mov rcx, qword [rbp + 0x20]
jmp 0x1400017ea
mov rsi, qword [rbp - 8]
movzx eax, byte [0x140029101]
mov ecx, 0x20
mov edx, 8
call fcn.140002490
test rax, rax
je 0x14000192a
mov qword [rax], r15
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rsi
lea rbx, [0x14001e600]
jmp 0x1400018d1
movzx eax, byte [0x140029101]
mov ecx, 1
mov edx, 1
call fcn.140002490
test rax, rax
mov rdx, qword [rbp + 0x38]
je 0x140001943
mov byte [rax], 3
lea rbx, [0x14001e500]
mov rcx, qword [rbp + 0x30]
jmp 0x1400018b8
movzx eax, byte [0x140029101]
mov ecx, 1
mov edx, 1
call fcn.140002490
test rax, rax
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
je 0x140001954
mov byte [rax], 4
lea rbx, [0x14001e500]
jmp 0x1400018b8
mov qword [rbp + 0x28], rcx
mov rsi, qword [rbp - 8]
movzx eax, byte [0x140029101]
mov ecx, 0x20
mov edx, 8
call fcn.140002490
test rax, rax
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
je 0x140001965
mov r8, qword [rbp + 0x28]
mov qword [rax], r8
mov qword [rax + 8], r13
mov r8, qword [rbp + 0x10]
mov qword [rax + 0x10], r8
mov qword [rax + 0x18], rsi
lea rbx, [0x14001e600]
jmp 0x1400018b8
mov qword [rbp - 0x28], rcx
mov rbx, qword [rbp - 8]
movzx eax, byte [0x140029101]
mov ecx, 0x20
mov edx, 8
call fcn.140002490
test rax, rax
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
mov r9, qword [rbp + 0x18]
mov r10, qword [rbp + 0x10]
je 0x14000197a
mov r8, qword [rbp - 0x28]
mov qword [rax], r8
mov qword [rax + 8], r13
mov r8, qword [rbp + 0x28]
mov qword [rax + 0x10], r8
mov qword [rax + 0x18], rbx
lea rbx, [0x14001e600]
jmp 0x140001817
movzx eax, byte [0x140029101]
mov ecx, 1
mov edx, 1
call fcn.140002490
test rax, rax
mov rcx, qword [rbp + 0x20]
je 0x14000198f
mov byte [rax], 1
lea rbx, [0x14001e500]
mov rdx, qword [rbp + 0x28]
mov byte [rcx], 0
test rdx, rdx
je 0x140001807
mov r8d, 1
mov r13, rax
call fcn.1400024a0
mov rax, r13
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
mov r9, qword [rbp + 0x18]
mov r10, qword [rbp + 0x10]
mov byte [r9], 0
test r10, r10
je 0x14000183f
mov r8d, 1
mov rcx, r9
mov rdx, r10
mov r13, rax
call fcn.1400024a0
mov rax, r13
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x30]
test rax, rax
jne 0x1400018b8
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r15
lea rax, [0x14001e6d8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 2
mov qword [rbp], 0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 1
lea rcx, [rbp - 0x20]
call fcn.140006120
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
mov r9, rbx
call sub.KERNEL32.dll_CreateRemoteThread
mov rcx, rax
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
mov byte [rcx], 0
test rdx, rdx
je 0x1400018d1
mov r8d, 1
mov rsi, rax
call fcn.1400024a0
mov rax, rsi
mov rdx, rbx
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movzx eax, byte [0x140029101]
mov ecx, 1
mov edx, 1
call fcn.140002490
test rax, rax
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
je 0x1400019a0
mov byte [rax], 2
lea rbx, [0x14001e500]
mov byte [rcx], 0
test rdx, rdx
jne 0x1400017f6
jmp 0x140001807
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x30], rdi
mov ecx, 8
mov edx, 0x20
call fcn.14001cca0
jmp 0x1400019af
mov ecx, 1
mov edx, 1
call fcn.14001cca0
jmp 0x1400019af
mov ecx, 1
mov edx, 1
call fcn.14001cca0
jmp 0x1400019af
mov qword [rbp + 0x18], r13
mov ecx, 8
mov edx, 0x20
call fcn.14001cca0
jmp 0x1400019af
mov qword [rbp + 0x20], r13
mov ecx, 8
mov edx, 0x20
call fcn.14001cca0
jmp 0x1400019af
mov ecx, 1
mov edx, 1
call fcn.14001cca0
jmp 0x1400019af
mov ecx, 1
mov edx, 1
call fcn.14001cca0
ud2