Function at 0x401530
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
lea rbp, [rsp + 0xe0]
call sym.__main
mov dword [rbp - 0x84], 0x60
mov eax, dword [rbp - 0x84]
mov rax, qword gs:[rax]
mov qword [rbp - 0x90], rax
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x38], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
sub rax, 0x10
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov rax, qword [rax + 0x30]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x4015e7
lea rax, str.Error:_Not_a_valid_PE_file._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x40190b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x3c]
cdqe
lea rdx, [rax + 4]
mov rax, qword [rbp - 0x48]
add rax, rdx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
add rax, 0x14
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0x70]
mov edx, eax
mov rax, qword [rbp - 0x48]
add rax, rdx
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x48]
mov rdx, rax
lea rax, str.Module_Base_Address:_0x_p_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
mov edx, eax
lea rax, str.DOS_Signature:_0x_X_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp - 0x20]
mov eax, dword [rax]
mov edx, eax
lea rax, str.NT_Signature:_0x_X_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp - 0x28]
movzx eax, word [rax + 2]
movzx eax, ax
mov edx, eax
lea rax, str.Number_of_Sections:__u_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0x70]
mov edx, eax
lea rax, str.Export_Table_RVA:_0x_X_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x58], 0
mov qword [rbp - 0x60], 0x1000
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.NtAllocateVirtualMemory
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x98], 0
mov qword [rbp - 0xa0], 0x1000
mov rbx, qword [rbp - 0x68]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rdx, [rbp - 0xa0]
lea rax, [rbp - 0x98]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
mov r9, rdx
mov r8d, 0
mov rdx, rax
call rbx
mov dword [rbp - 0x6c], eax
cmp dword [rbp - 0x6c], 0
jne 0x4018f2
mov rax, qword [rbp - 0x98]
mov rdx, rax
lea rax, str.NtAllocateVirtualMemory_succeeded._Allocated_at:_0x_p_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.Hello__NtWriteVirtualMemory_
mov qword [rbp - 0x78], rax
mov dword [rbp - 0xa4], 0
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.NtWriteVirtualMemory
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x80], rax
lea rax, str.Content_before_write:
mov rcx, rax
call sym.printf_char_const__::_
mov dword [rbp - 4], 0
jmp 0x4017f6
mov rdx, qword [rbp - 0x98]
mov eax, dword [rbp - 4]
cdqe
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
mov edx, eax
lea rax, str._02X
mov rcx, rax
call sym.printf_char_const__::_
add dword [rbp - 4], 1
mov eax, dword [rbp - 4]
movsxd rbx, eax
mov rax, qword [rbp - 0x78]
mov rcx, rax
call sym.strlen
cmp rbx, rax
jb 0x4017cc
lea rax, [0x0040a13e]
mov rcx, rax
call sym.printf_char_const__::_
mov rsi, qword [rbp - 0x80]
mov rax, qword [rbp - 0x78]
mov rcx, rax
call sym.strlen
mov edi, eax
mov rbx, qword [rbp - 0x98]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
mov rdx, qword [rbp - 0x78]
lea rax, [rbp - 0xa4]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, rdx
mov rdx, rbx
call rsi
mov dword [rbp - 0x6c], eax
cmp dword [rbp - 0x6c], 0
jne 0x4018dc
mov eax, dword [rbp - 0xa4]
mov edx, eax
lea rax, str.NtWriteVirtualMemory_succeeded._Bytes_written:__lu_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.Content_after_write:
mov rcx, rax
call sym.printf_char_const__::_
mov dword [rbp - 8], 0
jmp 0x4018be
mov rdx, qword [rbp - 0x98]
mov eax, dword [rbp - 8]
cdqe
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
mov edx, eax
lea rax, str._02X
mov rcx, rax
call sym.printf_char_const__::_
add dword [rbp - 8], 1
mov edx, dword [rbp - 8]
mov eax, dword [rbp - 0xa4]
cmp edx, eax
jb 0x401894
lea rax, [0x0040a13e]
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x401906
mov eax, dword [rbp - 0x6c]
mov edx, eax
lea rax, str.Error_calling_NtWriteVirtualMemory:_0x_X_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x401906
mov eax, dword [rbp - 0x6c]
mov edx, eax
lea rax, str.Error_calling_NtAllocateVirtualMemory:_0x_X_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
ret