Function at 0x140002860
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
mov rbx, rcx
movsxd rax, dword [rcx + 0x3c]
mov edi, dword [rax + rcx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x2e]
lea rdx, str.log_loadprocess.txt
lea rcx, [rsp + 0x40]
call fcn.140001670
nop
mov rdx, r12
lea rcx, str.___DLLs_data_at_0x_p_n
call fcn.1400044f0
lea rdx, str.___DLLs_data_at_0x
lea rcx, [rsp + 0x40]
call fcn.140001030
mov rdx, r12
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400126b8]
call fcn.140001030
movsxd rax, dword [r12 + 0x3c]
cmp dword [rax + r12], 0x4550
jne 0x140002faa
lea rcx, str.___The_PE_image_is_valid._n
call fcn.1400044f0
lea rdx, str.___The_PE_image_is_valid._n
lea rcx, [rsp + 0x40]
call fcn.140001030
movsxd rax, dword [r12 + 0x3c]
mov ecx, 0x2000
test word [rax + r12 + 0x16], cx
je 0x140002f8b
lea rcx, str.___The_PE_image_correspond_to_a_DLL._n
call fcn.1400044f0
lea rdx, str.___The_PE_image_correspond_to_a_DLL._n
lea rcx, [rsp + 0x40]
call fcn.140001030
movsxd rax, dword [r12 + 0x3c]
mov ecx, 0x20b
cmp word [rax + r12 + 0x18], cx
jne 0x140002f6c
lea rcx, str.___The_architectures_are_compatible._n
call fcn.1400044f0
lea rdx, str.____The_architectures_are_compatible___n
lea rcx, [rsp + 0x40]
call fcn.140001030
mov edx, edi
lea rcx, str.___PE_image_size_:_0x_x_n
call fcn.1400044f0
lea rdx, str.___PE_image_size_:_0x
lea rcx, [rsp + 0x40]
call fcn.140001030
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x140002a08
lea rcx, str.____An_error_is_occured_when_tying_to_allocate_the_DLLs_memory___n
call fcn.1400044f0
lea rdx, str.____An_error_is_occured_when_tying_to_allocate_the_DLLs_memory___n
lea rcx, [rsp + 0x40]
call fcn.140001030
jmp 0x140002fea
mov rdx, r15
lea rcx, str.___DLL_memory_allocated_at_0x_p_n
call fcn.1400044f0
lea rdx, str.___DLL_memory_allocated_at_0x
lea rcx, [rsp + 0x40]
call fcn.140001030
mov rdx, r15
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400126b8]
call fcn.140001030
movsxd rdi, dword [r12 + 0x3c]
add rdi, r12
mov qword [rbp + 0xa8], rdi
movzx r14d, word [rdi + 0x14]
add r14, rdi
mov rax, r15
sub rax, qword [rdi + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rdi + 0x30], r15
mov r8d, dword [rdi + 0x54]
mov rdx, r12
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rdi + 0xb0]
mov qword [rbp + 0xb8], rbx
mov rdi, qword [rdi + 0x90]
xor ecx, ecx
mov r13d, ecx
mov qword [rbp + 0xb0], rcx
mov dword [rbp + 0xa0], ecx
mov rax, qword [rbp + 0xa8]
cmp cx, word [rax + 6]
jae 0x140002f4d
add r14, 0x20
mov r9d, dword [r14 + 4]
cmp ebx, r9d
jb 0x140002acc
mov ecx, dword [r14]
add ecx, r9d
cmp ebx, ecx
jae 0x140002acc
lea r13, [r14 - 8]
cmp edi, r9d
jb 0x140002ae6
mov ecx, dword [r14]
add ecx, r9d
cmp edi, ecx
jae 0x140002ae6
lea rax, [r14 - 8]
mov qword [rbp + 0xb0], rax
mov r8d, dword [r14 + 8]
mov edx, dword [r14 + 0xc]
add rdx, r12
lea rcx, [r15 + r9]
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [r14 - 8]
lea rcx, str.___The_section__s_has_been_writed._n
call fcn.1400044f0
lea rdx, str.___The_section
lea rcx, [rsp + 0x40]
call fcn.140001030
mov rcx, rax
lea rdx, [r14 - 8]
call fcn.140001030
mov rcx, rax
lea rdx, str._has_been_writed._n
call fcn.140001030
mov ecx, dword [rbp + 0xa0]
inc ecx
mov dword [rbp + 0xa0], ecx
add r14, 0x28
mov rax, qword [rbp + 0xa8]
movzx eax, word [rax + 6]
cmp ecx, eax
jl 0x140002ab5
test r13, r13
je 0x140002f4d
mov rsi, qword [rbp + 0xb0]
test rsi, rsi
jne 0x140002b92
lea rcx, str.____An_error_is_occured_when_tying_to_get_the_import_section___n
call fcn.1400044f0
lea rdx, str.____An_error_is_occured_when_tying_to_get_the_import_section___n
lea rcx, [rsp + 0x40]
call fcn.140001030
jmp 0x140002fea
mov rdx, r13
lea rcx, str.___Relocation_in__s_section._n
call fcn.1400044f0
lea rdx, str.___Relocation_in
lea rcx, [rsp + 0x40]
call fcn.140001030
mov rcx, rax
mov rdx, r13
call fcn.140001030
mov rcx, rax
lea rdx, str._section._n
call fcn.140001030
mov rdx, rsi
lea rcx, str.___Import_in__s_section._n
call fcn.1400044f0
lea rdx, str.___Import_in
lea rcx, [rsp + 0x40]
call fcn.140001030
mov rcx, rax
mov rdx, rsi
call fcn.140001030
mov rcx, rax
lea rdx, str._section._n
call fcn.140001030
xor r8d, r8d
mov edi, dword [rbp + 0xbc]
test rdi, rdi
je 0x140002c8e
mov r11d, dword [r13 + 0x14]
mov esi, 0x1000
mov rbx, qword [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
mov r10d, r11d
add r10, r8
add r8, 8
mov r9d, dword [r10 + r12 + 4]
sub r9, 8
shr r9, 1
je 0x140002c89
mov edx, r11d
nop dword [rax + rax]
mov eax, edx
add rax, r8
add r8, 2
movzx ecx, word [rax + r12]
cmp cx, si
jb 0x140002c83
and ecx, 0xfff
mov edx, dword [r10 + r12]
lea rax, [r15 + rcx]
mov rcx, qword [rdx + rax]
add rcx, rbx
mov qword [rdx + rax], rcx
mov r11d, dword [r13 + 0x14]
mov edx, r11d
sub r9, 1
jne 0x140002c50
cmp r8, rdi
jb 0x140002c30
mov rdi, qword [rbp + 0xa8]
mov r14d, dword [rdi + 0x90]
add r14, r15
jne 0x140002cc3
lea rdx, str.____An_error_is_occured_when_tying_to_get_the_import_descriptor___n
lea rcx, [rsp + 0x40]
call fcn.140001030
lea rcx, str.____An_error_is_occured_when_tying_to_get_the_import_descriptor___n
call fcn.1400044f0
jmp 0x140002fea
add r14, 0xc
mov eax, dword [r14]
test eax, eax
je 0x140002df5
mov ebx, eax
add rbx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rdx, rbx
test rax, rax
je 0x140002e8d
lea rcx, str.___Loading__s_n
call fcn.1400044f0
lea rdx, str.___Loading
lea rcx, [rsp + 0x40]
call fcn.140001030
mov rcx, rax
mov rdx, rbx
call fcn.140001030
mov rcx, rax
lea rdx, [0x1400126b8]
call fcn.140001030
mov ebx, dword [r14 + 4]
add rbx, r15
mov rax, qword [rbx]
test rax, rax
je 0x140002ddf
nop dword [rax]
mov rcx, rsi
test rax, rax
jns 0x140002d82
movzx edi, ax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
mov edx, edi
lea rcx, str.___tFunction_Ordinal__u_n
call fcn.1400044f0
lea rdx, str.___tFunction_Ordinal
lea rcx, [rsp + 0x40]
call fcn.140001030
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64]
jmp 0x140002dc0
lea rdi, [r15 + 2]
add rdi, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
mov rdx, rdi
lea rcx, str.___tFunction__s_n
call fcn.1400044f0
lea rdx, str.___tFunction
lea rcx, [rsp + 0x40]
call fcn.140001030
mov rcx, rax
mov rdx, rdi
call fcn.140001030
lea rdx, [0x1400126b8]
mov rcx, rax
call fcn.140001030
add rbx, 8
mov rax, qword [rbx]
test rax, rax
jne 0x140002d40
add r14, 0x14
mov eax, dword [r14]
test eax, eax
jne 0x140002cd2
mov rdi, qword [rbp + 0xa8]
movsxd rax, dword [r12 + 0x3c]
cmp dword [rax + r12 + 0xd0], 0
je 0x140002e55
mov eax, dword [rdi + 0xd0]
mov rbx, qword [rax + r15 + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x140002e38
nop dword [rax + rax]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, r12
call rax
lea rbx, [rbx + 8]
mov rax, qword [rbx]
test rax, rax
jne 0x140002e20
lea rcx, str.___TLS_callbacks_executed__DLL_PROCESS_ATTACH_._n
call fcn.1400044f0
lea rdx, str.___TLS_callbacks_executed__DLL_PROCESS_ATTACH_._n
lea rcx, [rsp + 0x40]
call fcn.140001030
mov eax, dword [rdi + 0x28]
add rax, r15
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, r15
call rax
test eax, eax
jne 0x140002ec9
lea rcx, str.____An_error_is_occured_when_trying_to_call_the_DLLs_entrypoint___n
call fcn.1400044f0
lea rdx, str.____An_error_is_occured_when_trying_to_call_the_DLLs_entrypoint___n
lea rcx, [rsp + 0x40]
call fcn.140001030
jmp 0x140002fea
lea rcx, str.____An_error_is_occured_when_tying_to_load__s_DLL___n
call fcn.1400044f0
lea rdx, str.____An_error_is_occured_when_tying_to_load
lea rcx, [rsp + 0x40]
call fcn.140001030
mov rcx, rax
mov rdx, rbx
call fcn.140001030
mov rcx, rax
lea rdx, str._DLL___n
call fcn.140001030
jmp 0x140002fea
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, str.___dllmain_have_been_called__DLL_PROCESS_ATTACH_._n
call fcn.1400044f0
lea rcx, str.___DLL_loaded_successfully._n
call fcn.1400044f0
lea rdx, str.___dllmain_have_been_called__DLL_PROCESS_ATTACH_._n
lea rcx, [rsp + 0x40]
call fcn.140001030
lea rdx, str.___DLL_loaded_successfully._n
lea rcx, [rsp + 0x40]
call fcn.140001030
lea rcx, [rsp + 0x48]
call fcn.140003900
test rax, rax
jne 0x140002fed
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
jmp 0x140002fed
lea rcx, str.____An_error_is_occured_when_tying_to_get_the_relocation_section___n
call fcn.1400044f0
lea rdx, str.____An_error_is_occured_when_tying_to_get_the_relocation_section___n
lea rcx, [rsp + 0x40]
call fcn.140001030
jmp 0x140002fea
lea rcx, str.____The_architectures_are_not_compatible___n
call fcn.1400044f0
lea rdx, str.____The_architectures_are_not_compatible___n
lea rcx, [rsp + 0x40]
call fcn.140001030
jmp 0x140002fea
lea rcx, str.____The_PE_file_is_not_a_DLL___n
call fcn.1400044f0
lea rdx, str.____The_PE_file_is_not_a_DLL___n
lea rcx, [rsp + 0x40]
call fcn.140001030
jmp 0x140002fea
lea rcx, str.____The_DLL_is_not_a_valid_PE_file___n
call fcn.1400044f0
lea rdx, str.____The_DLL_is_not_a_valid_PE_file__
lea rcx, [rsp + 0x40]
call fcn.140001030
mov rcx, rax
lea rdx, [0x1400126b8]
call fcn.140001030
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r15d, r15d
mov rcx, qword [rsp + 0x40]
movsxd rdx, dword [rcx + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rdx + 0x40], rax
mov rcx, qword [rsp + 0x40]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0xa8]
mov dword [rsp + rdx + 0x3c], r8d
lea rcx, [rsp + 0x48]
call fcn.140001ec0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 0x18]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rax, r15
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret