Function at 0x140001ca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
movsxd rax, dword [rcx + 0x3c]
mov rbx, rcx
mov edi, dword [rax + rcx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
mov rbp, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, rbp
lea rcx, str.___DLLs_data_at_0x_p_n
call fcn.140002830
movsxd rcx, dword [rbp + 0x3c]
cmp dword [rcx + rbp], 0x4550
jne 0x140002126
lea rcx, str.___The_PE_image_is_valid._n
call fcn.140002830
movsxd rax, dword [rbp + 0x3c]
mov ecx, 0x2000
test word [rax + rbp + 0x16], cx
je 0x140002110
lea rcx, str.___The_PE_image_correspond_to_a_DLL._n
call fcn.140002830
movsxd rax, dword [rbp + 0x3c]
mov ecx, 0x20b
cmp word [rax + rbp + 0x18], cx
jne 0x1400020fa
lea rcx, str.___The_architectures_are_compatible._n
mov qword [rsp + 0x28], r15
call fcn.140002830
mov edx, edi
lea rcx, str.___PE_image_size_:_0x_x_n
call fcn.140002830
mov r9d, 0x40
mov r8d, 0x3000
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x140001d90
lea rcx, str.____An_error_is_occured_when_tying_to_allocate_the_DLLs_memory___n
call fcn.140002830
mov r15, qword [rsp + 0x28]
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x48], rsi
lea rcx, str.___DLL_memory_allocated_at_0x_p_n
mov qword [rsp + 0x40], r12
mov rdx, r15
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
call fcn.140002830
movsxd rdi, dword [rbp + 0x3c]
mov rax, r15
add rdi, rbp
mov rdx, rbp
mov rcx, r15
mov qword [rsp + 0x78], rdi
sub rax, qword [rdi + 0x30]
movzx r14d, word [rdi + 0x14]
mov r8d, dword [rdi + 0x54]
add r14, rdi
mov qword [rsp + 0x88], rax
mov qword [rdi + 0x30], r15
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rdi + 0xb0]
xor esi, esi
mov rax, qword [rsp + 0x78]
mov r13d, esi
mov rdi, qword [rdi + 0x90]
mov r12d, esi
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x70], esi
cmp si, word [rax + 6]
jae 0x1400020ee
add r14, 0x20
mov rsi, rax
mov r9d, dword [r14 + 4]
cmp ebx, r9d
jb 0x140001e38
mov ecx, dword [r14]
add ecx, r9d
cmp ebx, ecx
jae 0x140001e38
lea r13, [r14 - 8]
cmp edi, r9d
jb 0x140001e4b
mov ecx, dword [r14]
add ecx, r9d
cmp edi, ecx
jae 0x140001e4b
lea r12, [r14 - 8]
mov edx, dword [r14 + 0xc]
lea rcx, [r15 + r9]
mov r8d, dword [r14 + 8]
add rdx, rbp
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [r14 - 8]
lea rcx, str.___The_section__s_has_been_writed._n
call fcn.140002830
mov ecx, dword [rsp + 0x70]
add r14, 0x28
movzx eax, word [rsi + 6]
inc ecx
mov dword [rsp + 0x70], ecx
cmp ecx, eax
jl 0x140001e21
mov esi, 0
test r13, r13
je 0x1400020ee
test r12, r12
jne 0x140001ec7
lea rcx, str.____An_error_is_occured_when_tying_to_get_the_import_section___n
call fcn.140002830
xor eax, eax
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x28]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov rdx, r13
lea rcx, str.___Relocation_in__s_section._n
call fcn.140002830
mov rdx, r12
lea rcx, str.___Import_in__s_section._n
call fcn.140002830
mov ebx, dword [rsp + 0x84]
test rbx, rbx
je 0x140001f66
mov r10d, dword [r13 + 0x14]
mov edi, 0x1000
mov r11, qword [rsp + 0x88]
nop dword [rax]
nop word [rax + rax]
mov r9d, r10d
add r9, rsi
add rsi, 8
mov r8d, dword [r9 + rbp + 4]
sub r8, 8
shr r8, 1
je 0x140001f61
mov ecx, r10d
nop dword [rax + rax]
mov eax, ecx
add rax, rsi
add rsi, 2
movzx edx, word [rax + rbp]
cmp dx, di
jb 0x140001f5b
mov ecx, dword [r9 + rbp]
and edx, 0xfff
lea rax, [r15 + rdx]
add qword [rcx + rax], r11
mov r10d, dword [r13 + 0x14]
mov ecx, r10d
sub r8, 1
jne 0x140001f30
cmp rsi, rbx
jb 0x140001f10
mov rdi, qword [rsp + 0x78]
mov r14d, dword [rdi + 0x90]
add r14, r15
jne 0x140001f83
lea rcx, str.____An_error_is_occured_when_tying_to_get_the_import_descriptor___n
jmp 0x140001e9f
mov eax, dword [r14 + 0xc]
add r14, 0xc
test eax, eax
je 0x140002041
nop dword [rax]
nop word [rax + rax]
mov ebx, eax
add rbx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rdx, rbx
test rax, rax
je 0x1400020a9
lea rcx, str.___Loading__s_n
call fcn.140002830
mov ebx, dword [r14 + 4]
add rbx, r15
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000202c
jns 0x140001ffb
movzx edi, cx
mov rcx, rsi
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, edi
lea rcx, str.___tFunction_Ordinal__u_n
mov qword [rbx], rax
call fcn.140002830
jmp 0x14000201f
lea rdi, [rcx + r15]
mov rcx, rsi
lea rdx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rdi + 2]
mov qword [rbx], rax
lea rcx, str.___tFunction__s_n
call fcn.140002830
mov rcx, qword [rbx + 8]
add rbx, 8
test rcx, rcx
jne 0x140001fd8
mov eax, dword [r14 + 0x14]
add r14, 0x14
test eax, eax
jne 0x140001fa0
mov rdi, qword [rsp + 0x78]
movsxd rax, dword [rbp + 0x3c]
cmp dword [rax + rbp + 0xd0], 0
je 0x140002087
mov eax, dword [rdi + 0xd0]
mov rbx, qword [rax + r15 + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x14000207b
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x140002062
lea rcx, str.___TLS_callbacks_executed__DLL_PROCESS_ATTACH_._n
call fcn.140002830
mov eax, dword [rdi + 0x28]
xor r8d, r8d
add rax, r15
mov rcx, r15
lea edx, [r8 + 1]
call rax
test eax, eax
jne 0x1400020ba
lea rcx, str.____An_error_is_occured_when_trying_to_call_the_DLLs_entrypoint___n
jmp 0x140001e9f
lea rcx, str.____An_error_is_occured_when_tying_to_load__s_DLL___n
call fcn.140002830
jmp 0x140001ea4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, str.___dllmain_have_been_called__DLL_PROCESS_ATTACH_._n
call fcn.140002830
lea rcx, str.___DLL_loaded_successfully._n
call fcn.140002830
mov rax, r15
jmp 0x140001ea6
lea rcx, str.____An_error_is_occured_when_tying_to_get_the_relocation_section___n
jmp 0x140001e9f
lea rcx, str.____The_architectures_are_not_compatible___n
call fcn.140002830
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
lea rcx, str.____The_PE_file_is_not_a_DLL___n
call fcn.140002830
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
lea rcx, str.____The_DLL_is_not_a_valid_PE_file___n
call fcn.140002830
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret