Function at 0x140007dd0
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Resume thread

Disassembly:
push rbp
push r12
push r13
push r15
lea rbp, [rsp - 0x468]
sub rsp, 0x568
mov rax, qword [0x140043100]
xor rax, rsp
mov qword [rbp + 0x448], rax
movsxd r12, dword [rdx + 0x3c]
mov r15, rdx
add r12, rdx
mov dword [rsp + 0x20], 0x40
mov r13, rcx
mov qword [rsp + 0x60], r12
mov rcx, qword [rcx]
xor edx, edx
mov r9d, 0x3000
mov r8d, dword [r12 + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140008117
mov r9d, dword [r12 + 0x54]
mov rcx, rax
sub rcx, qword [r12 + 0x30]
mov r8, r15
mov qword [rsp + 0x58], rcx
mov rdx, rax
xor ecx, ecx
mov qword [r12 + 0x30], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000813a
mov qword [rsp + 0x5a0], rbx
xor r11d, r11d
movsxd rbx, dword [r15 + 0x3c]
mov qword [rsp + 0x560], rsi
mov qword [rsp + 0x550], r14
cmp dword [rbx + r15 + 0xb0], r11d
je 0x140007e9f
mov rbx, qword [rbx + r15 + 0xb0]
jmp 0x140007ea2
mov rbx, r11
mov r14, r11
mov qword [rsp + 0x48], rbx
mov esi, r11d
mov qword [rsp + 0x558], rdi
cmp r11w, word [r12 + 6]
jae 0x1400080f4
mov rdi, r11
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r12 + 0x14]
add rdx, 0x18
add rdx, rdi
add rdx, r12
mov r10d, dword [rdx + 0xc]
cmp ebx, r10d
jb 0x140007ef5
mov ecx, dword [rdx + 8]
add ecx, r10d
cmp ebx, ecx
cmovb r14, rdx
mov r8d, dword [rdx + 0x14]
mov r9d, dword [rdx + 0x10]
add r8, r15
mov rcx, qword [r13]
mov rdx, r10
add rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400081c6
movzx eax, word [r12 + 6]
inc esi
add rdi, 0x28
mov r11d, 0
cmp esi, eax
jl 0x140007ed0
test r14, r14
je 0x1400080f4
xor edx, edx
mov ebx, edx
cmp dword [rsp + 0x4c], edx
jbe 0x14000802b
mov r8d, 0x1000
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14 + 0x14]
add rax, r15
mov r12d, ebx
add r12, rax
add ebx, 8
mov eax, dword [r12 + 4]
sub rax, 8
shr rax, 1
test eax, eax
je 0x14000801c
mov esi, eax
nop word [rax + rax]
mov eax, dword [r14 + 0x14]
add rax, r15
mov ecx, ebx
add ebx, 2
movzx eax, word [rcx + rax]
cmp ax, r8w
jb 0x140008012
mov edi, dword [r12]
lea r8, [rbp + 0x440]
mov rcx, qword [r13]
and eax, 0xfff
add rax, qword [rsp + 0x50]
mov r9d, 8
add rdi, rax
mov qword [rbp + 0x440], rdx
mov qword [rsp + 0x20], rdx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x58]
lea r8, [rbp + 0x440]
add qword [rbp + 0x440], rax
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov r9d, 8
mov rcx, qword [r13]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
mov r8d, 0x1000
sub rsi, 1
jne 0x140007f90
cmp ebx, dword [rsp + 0x4c]
jb 0x140007f60
mov r12, qword [rsp + 0x60]
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x4d0
call fcn.14002c930
mov rcx, qword [r13 + 8]
lea rdx, [rsp + 0x70]
mov dword [rbp - 0x60], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000815d
mov rdx, qword [rbp - 8]
lea r8, [r12 + 0x30]
xor ecx, ecx
add rdx, 0x10
mov qword [rsp + 0x20], rcx
mov r9d, 8
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140008180
mov eax, dword [r12 + 0x28]
lea rdx, [rsp + 0x70]
add rax, qword [rsp + 0x50]
mov rcx, qword [r13 + 8]
mov qword [rbp - 0x10], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1400081a3
mov rcx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rdi, qword [rsp + 0x558]
mov rsi, qword [rsp + 0x560]
mov rbx, qword [rsp + 0x5a0]
mov r14, qword [rsp + 0x550]
mov rcx, qword [rbp + 0x448]
xor rcx, rsp
call fcn.140010750
add rsp, 0x568
pop r15
pop r13
pop r12
pop rbp
ret
lea rdx, str.Error_when_trying_to_get_the_relocation_section_of_the_source_image
lea rcx, [rsp + 0x30]
call fcn.140006ff0
lea rdx, [0x140041298]
lea rcx, [rsp + 0x30]
call fcn.1400127b8
int3
lea rdx, str.Error_when_trying_to_allocate_memory_for_the_new_image
lea rcx, [rsp + 0x30]
call fcn.140006ff0
lea rdx, [0x140041298]
lea rcx, [rsp + 0x30]
call fcn.1400127b8
int3
lea rdx, str.Error_when_trying_to_write_the_headers_of_the_new_image
lea rcx, [rsp + 0x30]
call fcn.140006ff0
lea rdx, [0x140041298]
lea rcx, [rsp + 0x30]
call fcn.1400127b8
int3
lea rdx, str.Error_when_trying_to_get_the_thread_context
lea rcx, [rsp + 0x30]
call fcn.140006ff0
lea rdx, [0x140041298]
lea rcx, [rsp + 0x30]
call fcn.1400127b8
int3
lea rdx, str.Error_when_trying_to_write_the_image_base_in_the_PEB
lea rcx, [rsp + 0x30]
call fcn.140006ff0
lea rdx, [0x140041298]
lea rcx, [rsp + 0x30]
call fcn.1400127b8
int3
lea rdx, str.Error_when_trying_to_set_the_thread_context
lea rcx, [rsp + 0x30]
call fcn.140006ff0
lea rdx, [0x140041298]
lea rcx, [rsp + 0x30]
call fcn.1400127b8
int3
lea rdx, str.Error_when_trying_to_write_the_section
lea rcx, [rsp + 0x30]
call fcn.140006ff0
lea rdx, [0x140041298]
lea rcx, [rsp + 0x30]
call fcn.1400127b8
int3