Function at 0x140001abc
Capabilities:
Create thread
Enumerate processes
Inject dll
Inject thread

Disassembly:
push rbp
sub rsp, 0x1a0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x138], rdx
mov dword [rbp + 0x11c], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x110], rax
mov dword [rbp - 0x40], 0x130
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x110]
mov rcx, rax
call sym.Process32First
test eax, eax
setne al
test al, al
je 0x140001b5f
mov rax, qword [rbp + 0x130]
lea rdx, [rbp - 0x40]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sym.strcmp
test eax, eax
jne 0x140001b43
mov eax, dword [rbp - 0x38]
mov dword [rbp + 0x11c], eax
jmp 0x140001b5f
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x110]
mov rcx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
jne 0x140001b1d
mov rax, qword [rbp + 0x110]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x11c], 0
jne 0x140001ba5
mov r9d, 0x10
lea r8, str.Error
lea rax, str.Could_not_find_the_process.
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
jmp 0x140001e31
mov eax, dword [rbp + 0x11c]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
jne 0x140001bfc
mov r9d, 0x10
lea r8, str.Error
lea rax, str.Could_not_open_the_process.
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
jmp 0x140001e31
mov rax, qword [rbp + 0x138]
mov rcx, rax
call sym.strlen
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x108]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x100], rax
cmp qword [rbp + 0x100], 0
jne 0x140001c86
mov r9d, 0x10
lea r8, str.Error
lea rax, str.Could_not_allocate_memory_in_the_process.
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov rax, qword [rbp + 0x108]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140001e31
mov rax, qword [rbp + 0x138]
mov rcx, rax
call sym.strlen
lea r8, [rax + 1]
mov rcx, qword [rbp + 0x138]
mov rdx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x108]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.LoadLibraryA
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov rcx, rax
mov rax, qword [rbp + 0x108]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rdx, qword [rbp + 0x100]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0
jne 0x140001da7
mov r9d, 0x10
lea r8, str.Error
lea rax, str.Could_not_create_the_remote_thread.
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov rdx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x108]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x108]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140001e31
mov rax, qword [rbp + 0xf8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rdx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x108]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x108]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov r9d, 0x40
lea r8, str.Success
lea rax, str.DLL_injected_successfully_
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
nop
add rsp, 0x1a0
pop rbp
ret