Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 8]
sub rsp, 0x108
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov eax, 0x5a4d
mov rdi, rcx
cmp word [0x140006110], ax
je 0x1400010b1
lea rcx, str.Invalid_file_n
call fcn.140001010
xor al, al
jmp 0x140001c2b
xor byte [0x140006080], 0x86
xor byte [0x140006081], 0xba
xor byte [0x140006082], 0x95
xor byte [0x140006083], 0x89
xor byte [0x140006084], 0xdd
xor byte [0x140006085], 0xbd
xor byte [0x140006086], 0x5d
xor byte [0x140006087], 0xe3
xor byte [0x140006088], 0xf7
xor byte [0x140006089], 0xe0
xor byte [0x14000608a], 0x34
xor byte [0x14000608b], 0x61
xor byte [0x14000608c], 0x10
xor byte [0x14000608d], 0x4b
xor byte [0x1400060c8], 0x29
xor byte [0x1400060c9], 0xe9
xor byte [0x1400060ca], 0x43
xor byte [0x1400060cb], 0x51
xor byte [0x1400060cc], 0xd8
xor byte [0x1400060cd], 5
xor byte [0x1400060ce], 0x32
xor byte [0x1400060cf], 0x7c
xor byte [0x1400060d0], 0x1c
xor byte [0x1400060d1], 0xf
xor byte [0x1400060d2], 0x7e
xor byte [0x1400060d3], 0xc6
xor byte [0x1400060d4], 0x12
xor byte [0x1400060d5], 0xe3
xor byte [0x1400060d6], 0x47
xor byte [0x1400060d7], 7
xor byte [0x1400060d8], 0x2b
xor byte [0x1400060d9], 0xf8
xor byte [0x1400060e0], 0xa5
xor byte [0x1400060e1], 0xf7
xor byte [0x1400060e2], 0x9c
xor byte [0x1400060e3], 0xc9
xor byte [0x1400060e4], 0x79
xor byte [0x1400060e5], 0xd4
xor byte [0x1400060e6], 0xaa
xor byte [0x1400060e7], 0x2b
xor byte [0x1400060e8], 0xe4
xor byte [0x1400060e9], 0x5e
xor byte [0x1400060ea], 0xc8
xor byte [0x1400060eb], 0x6b
xor byte [0x1400060ec], 0x60
xor byte [0x1400060ed], 0x65
xor byte [0x1400060ee], 0xbb
xor byte [0x1400060ef], 0x8c
xor byte [0x1400060f0], 0x57
xor byte [str.Nll_], 0xd
xor byte [0x1400060b1], 0x1e
xor byte [0x1400060b2], 9
xor byte [0x1400060b3], 0x40
xor byte [0x1400060b4], 0xe4
xor byte [0x1400060b5], 0x5b
xor byte [0x1400060b6], 0xc3
xor byte [0x1400060b7], 0x49
xor byte [0x1400060b8], 0xc1
xor byte [0x1400060b9], 0x55
xor byte [0x1400060ba], 0x17
xor byte [0x1400060bb], 0xf3
xor byte [0x1400060bc], 0xd3
xor byte [0x1400060bd], 0x71
xor byte [0x1400060be], 0xd2
xor byte [0x1400060bf], 0xdb
xor byte [0x1400060c0], 0x6a
xor byte [0x1400060c1], 0x1e
xor byte [0x1400060a0], 0x87
xor byte [0x1400060a1], 0xc
xor byte [0x1400060a2], 0xed
xor byte [0x1400060a3], 0xb8
xor byte [0x1400060a4], 0xad
xor byte [0x1400060a5], 0x84
xor byte [0x1400060a6], 0x69
xor byte [0x1400060a7], 0x7a
xor byte [0x1400060a8], 6
xor byte [0x1400060a9], 0xb2
xor byte [0x1400060aa], 0x90
xor byte [0x1400060ab], 0xe3
mov qword [rsp + 0x100], r13
mov qword [rsp + 0xf0], r15
xor byte [0x1400060ac], 0x84
lea rcx, str.kernel32.dll
xor byte [0x1400060ad], 0xb3
xor byte [0x1400060ae], 2
xor byte [0x1400060af], 0x7a
xor byte [0x1400060f8], 0xd0
xor byte [str.J_f_v], 0x23
xor byte [0x1400060fa], 0x7e
xor byte [0x1400060fb], 0x55
xor byte [0x1400060fc], 3
xor byte [0x1400060fd], 0x83
xor byte [0x1400060fe], 0x1a
xor byte [0x1400060ff], 0x68
xor byte [0x140006100], 0x33
xor byte [0x140006101], 0xf7
xor byte [0x140006102], 0x34
xor byte [0x140006103], 0xe2
xor byte [0x140006104], 0x89
xor byte [0x140006090], 0xf6
xor byte [0x140006091], 0x35
xor byte [0x140006092], 0x7f
xor byte [0x140006093], 0x71
xor byte [0x140006094], 0x59
xor byte [0x140006095], 0x98
xor byte [0x140006096], 0xd2
xor byte [0x140006097], 0x7d
xor byte [0x140006098], 0x80
xor byte [0x140006099], 0xd0
xor byte [0x14000609a], 3
xor byte [0x14000609b], 0x60
mov dword [0x14000cf28], 0x6c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x140006080]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x14000cf00], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400060a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x14000cf08], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400060f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x14000cf10], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400060c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x14000cf20], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400060e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x14000cf18], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Nll_
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movsxd r15, dword [0x14000614c]
lea r13, [0x140006110]
add r15, r13
mov qword [0x14000cef8], rax
mov eax, 0x8664
cmp word [r15 + 4], ax
je 0x1400014c7
lea rcx, str.Invalid_platform_n
call fcn.140001010
xor al, al
jmp 0x140001c1b
mov r8d, dword [r15 + 0x50]
xor edx, edx
mov r9d, 0x3000
mov qword [rsp + 0x138], r12
mov rcx, rdi
mov dword [rsp + 0x20], 4
call qword [0x14000cf00]
mov r12, rax
test rax, rax
jne 0x14000150f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Target_process_memory_allocation_failed__ex__0x_X_n
call fcn.140001010
xor al, al
jmp 0x140001c13
mov qword [rsp + 0xf8], r14
lea rcx, str.Allocated_Mem__n
xor r14d, r14d
mov dword [rbp - 0x2c], r14d
call fcn.140001010
mov rdx, qword [0x14000cf08]
lea rcx, str._p_Protected
call fcn.140001010
mov r8d, dword [r15 + 0x50]
lea rax, [rbp - 0x2c]
mov r9d, 0x40
mov qword [rsp + 0x20], rax
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.Writing_File_Header__n
mov qword [rsp + 0x50], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 1
mov qword [rbp - 0x78], 1
mov qword [rsp + 0x68], r12
mov qword [rbp - 0x80], r14
call fcn.140001010
mov r9d, 0x1000
mov qword [rsp + 0x20], r14
mov r8, r13
mov rdx, r12
mov rcx, rdi
call qword [0x14000cf20]
test eax, eax
jne 0x1400015f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_write_file_header_0x_X_n
call fcn.140001010
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14000cf10]
xor al, al
jmp 0x140001c0b
mov qword [rsp + 0x128], rbx
lea rcx, str.Wrote_File_Header__n
mov qword [rsp + 0x130], rsi
call fcn.140001010
movzx ebx, word [r15 + 0x14]
mov esi, r14d
add rbx, 0x28
cmp word [r15 + 6], r14w
je 0x140001667
add rbx, r15
nop dword [rax + rax]
mov eax, dword [rbx]
test eax, eax
je 0x140001658
mov r8d, dword [rbx + 4]
mov r9d, eax
mov edx, dword [rbx - 4]
add r8, r13
add rdx, r12
mov qword [rsp + 0x20], r14
mov rcx, rdi
call qword [0x14000cf20]
test eax, eax
je 0x1400016bc
movzx eax, word [r15 + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jne 0x140001630
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x40
mov rcx, rdi
call qword [0x14000cf00]
mov r13, rax
test rax, rax
jne 0x1400016ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Target_process_mapping_allocation_failed__ex__0x_X_n
call fcn.140001010
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14000cf10]
jmp 0x140001bf9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_map_sections:_0x_x_n
call fcn.140001010
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14000cf10]
jmp 0x140001bf9
mov r9d, 0x40
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x50]
mov rdx, r13
mov rcx, rdi
call qword [0x14000cf20]
test eax, eax
jne 0x14000174d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_write_mapping_0x_X_n
call fcn.140001010
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14000cf10]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, rdi
call qword [0x14000cf10]
jmp 0x140001bf9
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rdi
call qword [0x14000cf00]
mov qword [rsp + 0x48], rax
mov rsi, rax
test rax, rax
jne 0x1400017bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Memory_shellycody_allocation_failed__ex__0x_X_n
call fcn.140001010
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14000cf10]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, rdi
call qword [0x14000cf10]
jmp 0x140001bf9
mov r9d, 0x1000
mov qword [rsp + 0x20], r14
lea r8, [0x140001c50]
mov rdx, rsi
mov rcx, rdi
call qword [0x14000cf20]
test eax, eax
jne 0x140001836
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_write_shellycody_0x_X_n
call fcn.140001010
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14000cf10]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, rdi
call qword [0x14000cf10]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [0x14000cf10]
jmp 0x140001bf9
mov qword [rsp + 0x30], r14
mov r9, rsi
mov dword [rsp + 0x28], r14d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r13
mov rcx, rdi
call qword [0x14000cef8]
test rax, rax
jne 0x1400018b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Thread_creation_failed_0x_X_n
call fcn.140001010
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14000cf10]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, rdi
call qword [0x14000cf10]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [0x14000cf10]
jmp 0x140001bf9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rbp - 0x30]
cmp edx, 0x103
jne 0x140001bed
xorps xmm0, xmm0
mov qword [rsp + 0x20], r14
mov r9d, 0x40
lea r8, [rbp - 0x70]
mov rdx, r13
mov rcx, rdi
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
call qword [0x14000cf18]
mov rbx, qword [rbp - 0x50]
cmp rbx, 0x404040
je 0x140001bdc
cmp rbx, 0x505050
jne 0x140001934
lea rcx, str.WARNING:_Exception_support_failed__n
call fcn.140001010
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x1400018c0
mov ecx, 0x1400000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
mov r14, rax
test rax, rax
jne 0x140001971
lea rcx, str.Unable_to_allocate_memory_n
call fcn.140001010
jmp 0x140001bf9
xor edx, edx
mov r8d, 0x1400000
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1000
mov qword [rsp + 0x20], 0
mov r8, r14
mov rdx, r12
mov rcx, rdi
call qword [0x14000cf20]
test eax, eax
jne 0x1400019af
lea rcx, str.WARNING_:_Cant_clear_HEADER_n
call fcn.140001010
movzx ebx, word [r15 + 0x14]
xor esi, esi
movzx ecx, word [r15 + 6]
add rbx, 0x18
add rbx, r15
test cx, cx
je 0x140001a8f
lea rdx, str..rsrc
lea r8, str..reloc
nop dword [rax]
cmp dword [rbx + 8], 0
je 0x140001a7c
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140001a05
cmp rcx, 6
jne 0x1400019f0
jmp 0x140001a24
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140001a7c
cmp rcx, 7
jne 0x140001a10
mov rdx, rbx
lea rcx, str.Processing__s_removal_n
call fcn.140001010
mov edx, dword [rbx + 0xc]
mov r8, r14
mov r9d, dword [rbx + 8]
add rdx, r12
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [0x14000cf20]
test eax, eax
jne 0x140001a6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
lea rcx, str.Cant_clear_section__s:_0x_x_n
mov r8d, eax
call fcn.140001010
lea r8, str..reloc
lea rdx, str..rsrc
movzx ecx, word [r15 + 6]
inc esi
add rbx, 0x28
cmp esi, ecx
jne 0x1400019e0
movzx ebx, word [r15 + 0x14]
xor r14d, r14d
add rbx, 0x18
add rbx, r15
test cx, cx
je 0x140001b2d
mov edx, 0x20
nop dword [rax]
mov ecx, dword [rbx + 8]
test ecx, ecx
je 0x140001b1c
mov eax, dword [rbx + 0x24]
mov dword [rbp - 0x30], 0
test eax, 0x80000000
jbe 0x140001acf
mov esi, 4
jmp 0x140001adc
test eax, 0x20000000
mov esi, 2
cmova esi, edx
mov edx, dword [rbx + 0xc]
lea rax, [rbp - 0x30]
mov r8, rcx
mov qword [rsp + 0x20], rax
add rdx, r12
mov r9d, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r8d, esi
lea rcx, str.section__s_set_as__lX_n
mov rdx, rbx
test eax, eax
jne 0x140001b12
lea rcx, str.FAIL:_section__s_not_set_as__lX_n
call fcn.140001010
mov edx, 0x20
movzx eax, word [r15 + 6]
inc r14d
add rbx, 0x28
cmp r14d, eax
jne 0x140001ab0
movzx eax, word [r15 + 0x14]
mov r9d, 2
mov dword [rbp - 0x28], 0
mov rdx, r12
mov rcx, rdi
mov r8d, dword [rax + r15 + 0x24]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rbx, qword [rsp + 0x48]
mov r9d, 0x1000
mov r8, qword [rsp + 0x40]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [0x14000cf20]
test eax, eax
jne 0x140001b8e
lea rcx, str.WARNING:_Cant_clear_shellycody_n
call fcn.140001010
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [0x14000cf10]
test eax, eax
jne 0x140001bb3
lea rcx, str.WARNING:_cant_release_shellycody_memory_n
call fcn.140001010
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, rdi
call qword [0x14000cf10]
test eax, eax
jne 0x140001bd8
lea rcx, str.WARNING:_cant_release_mapping_data_memory_n
call fcn.140001010
mov al, 1
jmp 0x140001bfb
lea rcx, str.Wrong_mapping_ptr_n
call fcn.140001010
jmp 0x1400017f2
lea rcx, str.Process_crashed__exit_code:__d_n
call fcn.140001010
xor al, al
mov rsi, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x128]
mov r14, qword [rsp + 0xf8]
mov r12, qword [rsp + 0x138]
mov r13, qword [rsp + 0x100]
mov r15, qword [rsp + 0xf0]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140002450
add rsp, 0x108
pop rdi
pop rbp
ret