Function at 0x140001997
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
sub rsp, 0x228
lea rbp, [rsp + 0x80]
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov qword [rbp + 0x180], rax
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0x178], rax
cmp qword [rbp + 0x178], 0
jne 0x1400019fa
lea rax, str.____Error_loading_ntdll.dll._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140002193
lea rax, str.___Loaded_ntdll.dll_successfully._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x178]
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x170], rax
cmp qword [rbp + 0x170], 0
jne 0x140001a60
lea rax, str.____Failed_to_get_the_address_of_RtlAdjustPrivilege._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x178]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
mov eax, 1
jmp 0x140002193
lea rax, str.___Obtained_address_of_RtlAdjustPrivilege_successfully._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x178]
lea rdx, str.NtSetInformationProcess
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
jne 0x140001ac6
lea rax, str.____Failed_to_get_the_address_of_NtSetInformationProcess._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x178]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
mov eax, 1
jmp 0x140002193
lea rax, str.___Obtained_address_of_NtSetInformationProcess_successfully._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x170]
lea rdx, [rbp + 0xf3]
mov r9, rdx
mov r8d, 0
mov edx, 1
mov ecx, 0x14
call rax
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0
je 0x140001b3b
mov eax, dword [rbp + 0x164]
mov edx, eax
lea rax, str.____Error_adjusting_privilege:__lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x178]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
mov eax, 1
jmp 0x140002193
lea rax, str.___Privilege_adjusted_successfully._n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0
jne 0x140001b87
lea rax, str.____Failed_to_get_handle_of_the_default_loaded_ntdll.dll._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0xffffffff
jmp 0x140002193
mov rax, qword [rbp + 0x158]
mov rdx, rax
lea rax, str.___Memory_address_of_the_default_loaded_ntdll.dll:__p_n
mov rcx, rax
call sym.printf_char_const__::_
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xdf], 0
mov qword [rbp + 0x150], 0
mov dword [rbp + 0xcc], 0
mov qword [rbp + 0x148], 0
mov dword [rbp + 0x144], 0
mov dword [rbp + 0xc8], 0
mov qword [rbp + 0x138], 0
mov rax, qword [rbp + 0x178]
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x130], rax
cmp qword [rbp + 0x130], 0
jne 0x140001c57
lea rax, str.____Failed_to_get_address_of_RtlInitUnicodeString._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x178]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
mov eax, 0xffffffff
jmp 0x140002193
mov qword [rbp + 0x88], 0
mov dword [rbp + 0x12c], 0
movabs rax, 0x5c003f003f005c
movabs rdx, 0x55005c003a0043
mov qword [rbp], rax
mov qword [rbp + 8], rdx
movabs rax, 0x73007200650073
movabs rdx, 0x6600650044005c
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
movabs rax, 0x74006c00750061
movabs rdx, 0x7000700041005c
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
movabs rax, 0x61007400610044
movabs rdx, 0x63006f004c005c
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdx
movabs rax, 0x54005c006c0061
movabs rdx, 0x5c0070006d0065
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
movabs rax, 0x6c006c00650068
movabs rdx, 0x6f006c002e006f
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
mov dword [rbp + 0x60], 0x67
mov r8, qword [rbp + 0x130]
mov rdx, rbp
lea rax, [rbp + 0x70]
mov rcx, rax
call r8
lea rax, [rbp - 0x10]
mov r8d, 0x10
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x90], 0x30
mov qword [rbp + 0x98], 0
mov dword [rbp + 0xa8], 0x40
lea rax, [rbp + 0x70]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, str.c:windows_system32_ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x148]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x144], eax
mov ebx, dword [rbp + 0x144]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x138], rax
lea r8, [rbp + 0xc8]
mov ecx, dword [rbp + 0x144]
mov rdx, qword [rbp + 0x138]
mov rax, qword [rbp + 0x148]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x138]
mov rdx, rax
lea rax, str.___Memory_location_of_loaded_ntdll.dll:__p_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x138]
add rax, rdx
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x118]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x118]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x198], rax
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x190], rax
mov byte [rbp + 0x18f], 0
mov dword [rbp + 0x188], 0
jmp 0x140001f41
mov rax, qword [rbp + 0x198]
lea rdx, str..rdata
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140001f32
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x190], rax
lea rax, str.___.rdata_section_found._n
mov rcx, rax
call sym.printf_char_const__::_
mov byte [rbp + 0x18f], 1
jmp 0x140001f57
add qword [rbp + 0x198], 0x28
add dword [rbp + 0x188], 1
mov rax, qword [rbp + 0x118]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x188], eax
jl 0x140001ef2
movzx eax, byte [rbp + 0x18f]
xor eax, 1
test al, al
je 0x140001f74
lea rax, str.____.rdata_section_not_found._n
mov rcx, rax
call sym.printf_char_const__::_
mov edx, dword [rbp + 0x114]
mov rax, qword [rbp + 0x138]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x190]
mov rdx, rax
call sym.RVAtoRawOffset_unsigned_long_long___IMAGE_SECTION_HEADER_
mov qword [rbp + 0x100], rax
lea rax, [rbp + 0xd0]
mov qword [rbp + 0xf8], rax
lea rdx, [rbp + 0xcc]
lea rax, [rbp + 0xd0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
lea rax, str.NtCreateFile
mov rcx, rax
call sym.getHashFromString_char_const_
mov dword [rbp + 0xf4], eax
mov eax, dword [rbp + 0xf4]
mov edx, eax
lea rax, str.hash_of_function_CreateFile:_0x_x_n
mov rcx, rax
call sym.printf_char_const__::_
mov r8, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rbp + 0xf4]
lea rdx, [rbp + 0xd0]
mov qword [rsp + 0x30], rdx
mov rdx, qword [rbp + 0x190]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x108]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
lea rdx, str.NtCreateFile
mov ecx, eax
call sym.GetSyscallStubMem_unsigned_long__char_const___IMAGE_EXPORT_DIRECTORY__void___IMAGE_SECTION_HEADER___IMAGE_SECTION_HEADER__void_
test eax, eax
setne al
test al, al
je 0x1400020e4
mov rax, qword [rbp + 0xf8]
mov rdx, rax
lea rax, str.___Memory_location_of_NtCreateFile_syscall_stub_outwith_EAT:__p_n
mov rcx, rax
call sym.printf_char_const__::_
mov r10, qword [rbp + 0xf8]
lea rcx, [rbp - 0x10]
lea rdx, [rbp + 0x90]
lea rax, [rbp + 0x88]
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8, rdx
mov edx, 0x120116
mov rcx, rax
call r10
lea rax, str.___NtCreateFile_executed_successfully._n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x1400020f3
lea rax, str.____Failed_to_execute_NtCreateFile._n
mov rcx, rax
call sym.printf_char_const__::_
mov dword [rbp - 0x20], 0
mov dword [rbp - 0x1c], 0
mov qword [rbp - 0x18], 0
mov r10, qword [rbp + 0x168]
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x180]
mov r9d, 0x10
mov r8, rdx
mov edx, 0x28
mov rcx, rax
call r10
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0
je 0x140002157
mov eax, dword [rbp + 0x164]
mov edx, eax
lea rax, str.____Error_removing_the_callback:__lx_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x140002166
lea rax, str.___Callback_removed_successfully._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, rbp
mov rcx, rax
call sym.checkAndDeleteFile_wchar_t_const_
lea rax, str.___Successful__CtrlC_to_exit._n
mov rcx, rax
call sym.printf_char_const__::_
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, 0
add rsp, 0x228
pop rbx
pop rbp
ret