Function at 0x140011451
Capabilities:
Create thread
Enumerate processes
Inject dll
Inject thread

Disassembly:
jmp 0x14001ac10
push rbp
push rdi
sub rsp, 0xb38
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x1fe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002c040]
xor rax, rbp
mov qword [rbp + 0xae0], rax
mov dword [rbp + 0xaa4], 0
lea rcx, [0x1400330fd]
call fcn.1400118d9
xor edx, edx
mov ecx, 2
call fcn.14001144c
mov qword [rbp + 8], rax
mov dword [rbp + 0x30], 0x238
mov dword [rbp + 0x284], 0
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001159b
lea rdx, [rbp + 0x5c]
lea rcx, [rbp + 0x6a8]
call fcn.1400112c6
mov qword [rbp + 0xab8], rax
mov rax, qword [rbp + 0xab8]
mov qword [rbp + 0xac0], rax
mov eax, dword [rbp + 0xaa4]
or eax, 1
mov dword [rbp + 0xaa4], eax
lea rdx, [0x140027258]
mov rcx, qword [rbp + 0xac0]
call fcn.1400112e4
movzx eax, al
test eax, eax
jne 0x14001ad2d
lea rdx, [rbp + 0x5c]
lea rcx, [rbp + 0x6e8]
call fcn.1400112c6
mov qword [rbp + 0xac8], rax
mov rax, qword [rbp + 0xac8]
mov qword [rbp + 0xad0], rax
mov eax, dword [rbp + 0xaa4]
or eax, 2
mov dword [rbp + 0xaa4], eax
lea rdx, str.craftrise_x64.exe
mov rcx, qword [rbp + 0xad0]
call fcn.1400112e4
movzx eax, al
test eax, eax
jne 0x14001ad2d
mov dword [rbp + 0xad8], 0
jmp 0x14001ad37
mov dword [rbp + 0xad8], 1
movzx eax, byte [rbp + 0xad8]
mov byte [rbp + 0x684], al
mov eax, dword [rbp + 0xaa4]
and eax, 2
test eax, eax
je 0x14001ad65
and dword [rbp + 0xaa4], 0xfffffffd
lea rcx, [rbp + 0x6e8]
call fcn.1400117da
nop
mov eax, dword [rbp + 0xaa4]
and eax, 1
test eax, eax
je 0x14001ad85
and dword [rbp + 0xaa4], 0xfffffffe
lea rcx, [rbp + 0x6a8]
call fcn.1400117da
movzx eax, byte [rbp + 0x684]
test eax, eax
je 0x14001ad9b
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x284], eax
jmp 0x14001adb0
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400117df
test eax, eax
jne 0x14001ac85
cmp dword [rbp + 0x284], 0
jne 0x14001ae1d
lea rdx, str.error
lea rcx, [rbp + 0x728]
call fcn.140011406
nop
lea rdx, str.Oyun_bulunamadi.
lea rcx, [rbp + 0x768]
call fcn.140011406
nop
lea rdx, [rbp + 0x728]
lea rcx, [rbp + 0x768]
call fcn.1400118ed
nop
lea rcx, [rbp + 0x768]
call fcn.140011190
nop
lea rcx, [rbp + 0x728]
call fcn.140011190
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001b264
mov r8d, dword [rbp + 0x284]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x2a8], rax
cmp qword [rbp + 0x2a8], 0
jne 0x14001aea6
lea rdx, str.error
lea rcx, [rbp + 0x7a8]
call fcn.140011406
nop
lea rdx, str.Oyun_hafizasina_erisilemedi.
lea rcx, [rbp + 0x7e8]
call fcn.140011406
nop
lea rdx, [rbp + 0x7a8]
lea rcx, [rbp + 0x7e8]
call fcn.1400118ed
nop
lea rcx, [rbp + 0x7e8]
call fcn.140011190
nop
lea rcx, [rbp + 0x7a8]
call fcn.140011190
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001b264
lea rdx, str.C:MoonMoon.dll
lea rcx, [rbp + 0x2c8]
call fcn.1400112c6
nop
lea rcx, [rbp + 0x2c8]
call fcn.140011172
lea rax, [rax + rax + 2]
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0
jne 0x14001af7a
lea rdx, str.error
lea rcx, [rbp + 0x828]
call fcn.140011406
nop
lea rdx, str.Oyun_hafizasinda_alan_olusturulamadi.
lea rcx, [rbp + 0x868]
call fcn.140011406
nop
lea rdx, [rbp + 0x828]
lea rcx, [rbp + 0x868]
call fcn.1400118ed
nop
lea rcx, [rbp + 0x868]
call fcn.140011190
nop
lea rcx, [rbp + 0x828]
call fcn.140011190
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400117da
jmp 0x14001b264
lea rcx, [rbp + 0x2c8]
call fcn.140011172
lea rax, [rax + rax + 2]
mov qword [rbp + 0xab8], rax
lea rcx, [rbp + 0x2c8]
call fcn.1400112d5
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0xab8]
mov r9, rcx
mov r8, rax
mov rdx, qword [rbp + 0x308]
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x328], rax
cmp qword [rbp + 0x328], 0
jne 0x14001b064
lea rdx, str.error
lea rcx, [rbp + 0x8a8]
call fcn.140011406
nop
lea rdx, str.Kernel32.dll_bulunamadi.
lea rcx, [rbp + 0x8e8]
call fcn.140011406
nop
lea rdx, [rbp + 0x8a8]
lea rcx, [rbp + 0x8e8]
call fcn.1400118ed
nop
lea rcx, [rbp + 0x8e8]
call fcn.140011190
nop
lea rcx, [rbp + 0x8a8]
call fcn.140011190
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400117da
jmp 0x14001b264
lea rdx, str.LoadLibraryW
mov rcx, qword [rbp + 0x328]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x348], rax
cmp qword [rbp + 0x348], 0
jne 0x14001b107
lea rdx, str.error
lea rcx, [rbp + 0x928]
call fcn.140011406
nop
lea rdx, str.LoadLibraryW_islevi_bulunamadi.
lea rcx, [rbp + 0x968]
call fcn.140011406
nop
lea rdx, [rbp + 0x928]
lea rcx, [rbp + 0x968]
call fcn.1400118ed
nop
lea rcx, [rbp + 0x968]
call fcn.140011190
nop
lea rcx, [rbp + 0x928]
call fcn.140011190
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400117da
jmp 0x14001b264
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x308]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x348]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x368], rax
cmp qword [rbp + 0x368], 0
jne 0x14001b1cc
lea rdx, str.error
lea rcx, [rbp + 0x9a8]
call fcn.140011406
nop
lea rdx, str.Remote_thread_olusturulamadi.
lea rcx, [rbp + 0x9e8]
call fcn.140011406
nop
lea rdx, [rbp + 0x9a8]
lea rcx, [rbp + 0x9e8]
call fcn.1400118ed
nop
lea rcx, [rbp + 0x9e8]
call fcn.140011190
nop
lea rcx, [rbp + 0x9a8]
call fcn.140011190
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400117da
jmp 0x14001b264
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x368]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x368]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.success
lea rcx, [rbp + 0xa28]
call fcn.140011406
nop
lea rdx, str.Moon_yuklendi.
lea rcx, [rbp + 0xa68]
call fcn.140011406
nop
lea rdx, [rbp + 0xa28]
lea rcx, [rbp + 0xa68]
call fcn.1400118ed
nop
lea rcx, [rbp + 0xa68]
call fcn.140011190
nop
lea rcx, [rbp + 0xa28]
call fcn.140011190
nop
lea rcx, [rbp + 0x2c8]
call fcn.1400117da
lea rcx, [rbp - 0x40]
lea rdx, [0x1400262c0]
call fcn.140011780
mov rcx, qword [rbp + 0xae0]
xor rcx, rbp
call fcn.14001146a
lea rsp, [rbp + 0xaf8]
pop rdi
pop rbp
ret