Function at 0x140001f50
Capabilities:
Create process on windows
Create process suspended
Get file size
Read file on windows
Terminate process

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x4f8]
sub rsp, 0x5f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
cmp ecx, 3
jne 0x140002520
mov rax, qword [rdx + 8]
lea rcx, str._PROCESS_HOLLOWING__n
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 + 8], rbx
mov qword [r11 - 0x18], r12
mov qword [0x140006668], rax
mov rax, qword [rdx + 0x10]
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
mov qword [0x140006670], rax
call fcn.140001010
mov rcx, qword [0x140006668]
xor edi, edi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140002004
lea rcx, str.____An_error_occured_when_trying_to_open_the_PE_file___n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400022fe
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0xffffffff
jne 0x140002031
lea rcx, str.____An_error_occured_when_trying_to_get_the_PE_file_size___n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400022fe
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002071
lea rcx, str.____An_error_occured_when_trying_to_allocate_memory_for_the_PE_file_content___n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400022fe
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov r8d, r14d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400020b8
lea rcx, str.____An_error_occured_when_trying_to_read_the_PE_file_content___n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400022fe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400022fe
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400022fe
mov rdx, rbx
lea rcx, str.___PE_file_content_:_0x_p_n
call fcn.140001010
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x1400024fb
lea rcx, str.___The_PE_file_is_valid._n
call fcn.140001010
mov rcx, qword [0x140006670]
xorps xmm0, xmm0
xor eax, eax
mov dword [rbp + 0x450], 0x68
mov dword [rbp + 0x4b4], eax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x450]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
movups xmmword [rbp + 0x454], xmm0
movups xmmword [rbp + 0x464], xmm0
movups xmmword [rbp + 0x474], xmm0
movups xmmword [rbp + 0x484], xmm0
movups xmmword [rbp + 0x494], xmm0
movups xmmword [rbp + 0x4a4], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140002194
lea rcx, str.____An_error_is_occured_when_trying_to_create_the_target_process___n
jmp 0x1400024a9
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp + 0x440]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor edx, edx
mov qword [rsp + 0x68], rdi
cmp dword [rbp + 0x440], edi
je 0x140002220
mov r8d, 0x2c8
lea rcx, [rsp + 0x74]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
mov edx, dword [rbp + 0x14]
lea r8, [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
add edx, 8
mov r9d, 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140002214
mov rsi, qword [rsp + 0x68]
mov edx, dword [rbp + 0x14]
test rsi, rsi
je 0x140002214
test rdx, rdx
jne 0x140002281
lea rcx, str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
jmp 0x1400024a9
mov r8d, 0x4d0
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov dword [rbp - 0x60], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, qword [rbp - 8]
lea r8, [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140002214
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rbp - 8]
test rsi, rsi
je 0x140002214
test rdx, rdx
je 0x140002214
lea rcx, str.___Target_Process_PEB_:_0x_p_n
call fcn.140001010
mov rdx, rsi
lea rcx, str.___Target_Process_Image_Base_:_0x_p_n
call fcn.140001010
movsxd rax, dword [rbx + 0x3c]
lea rcx, str.___Source_PE_Image_architecture_:_x86_n
mov r12d, 0x10b
movzx r14d, word [rax + rbx + 0x18]
lea rax, str.___Source_PE_Image_architecture_:_x64_n
cmp r14w, r12w
cmovne rcx, rax
call fcn.140001010
cmp dword [rbp + 0x440], edi
lea rax, str.___Target_PE_Image_architecture_:_x64_n
lea rcx, str.___Target_PE_Image_architecture_:_x86_n
cmove rcx, rax
call fcn.140001010
cmp r14w, r12w
jne 0x14000234b
cmp dword [rbp + 0x440], edi
jne 0x140002353
lea rcx, str.____Architecture_are_not_compatible___n
call fcn.140001010
mov eax, 0xffffffff
mov r14, qword [rsp + 0x5d8]
mov r12, qword [rsp + 0x5e0]
mov rbx, qword [rsp + 0x600]
mov r15, qword [rsp + 0x5d0]
mov rsi, qword [rsp + 0x610]
mov rdi, qword [rsp + 0x5e8]
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.140002550
add rsp, 0x5f0
pop rbp
ret
cmp dword [rbp + 0x440], edi
jne 0x1400022f2
lea rcx, str.___Architecture_are_compatible___n
call fcn.140001010
movsxd rax, dword [rbx + 0x3c]
movzx ecx, word [rbx + rax + 0x5c]
movzx r15d, cx
lea rcx, str.___Source_Image_subsystem_:_0x_X_n
mov edx, r15d
call fcn.140001010
mov rdx, rsi
mov rcx, qword [rsp + 0x50]
cmp dword [rbp + 0x440], edi
je 0x140002392
call fcn.140001070
jmp 0x140002397
call fcn.1400011d0
mov esi, eax
cmp eax, 0xffffffff
jne 0x1400023aa
lea rcx, str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_target_process._n
jmp 0x1400024a9
mov edx, esi
lea rcx, str.___Target_Process_subsystem_:_0x_X_n
call fcn.140001010
cmp r15d, esi
jne 0x1400024a2
lea rcx, str.___Subsytems_are_compatible._n
call fcn.140001010
movsxd rax, dword [rbx + 0x3c]
cmp r14w, r12w
jne 0x1400023e0
cmp dword [rbx + rax + 0xa0], edi
jmp 0x1400023e7
cmp dword [rbx + rax + 0xb0], edi
setne dil
lea rax, str.___The_source_image_has_a_relocation_table._n
test edi, edi
lea rcx, str.___The_source_image_doesnt_have_a_relocation_table._n
cmovne rcx, rax
call fcn.140001010
lea rcx, [rsp + 0x50]
mov rdx, rbx
cmp r14w, r12w
jne 0x140002444
test edi, edi
jne 0x140002421
call fcn.140001340
test eax, eax
je 0x14000242a
jmp 0x14000245b
call fcn.1400017c0
test eax, eax
jne 0x14000245b
mov rdi, rbx
lea rcx, str.____The_injection_has_failed___n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
jmp 0x1400024b7
test edi, edi
mov rdi, rbx
jne 0x140002452
call fcn.140001580
jmp 0x140002457
call fcn.140001ba0
test eax, eax
je 0x14000242d
lea rcx, str.___The_injection_has_succeed___n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000248b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000249b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140002303
lea rcx, str.____Subsytems_are_not_compatible._n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400024d2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400022fe
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400022fe
lea rcx, str.____The_PE_file_is_not_valid___n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400022fe
lea rcx, str._HELP__runpe.exe__pe_file___target_process__n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x140002333