Function at 0x180001300
Capabilities:
Enumerate pe sections
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov r14, rdx
mov rbx, rcx
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x180001343
xor al, al
jmp 0x180001bce
movsxd r13, dword [rdx + 0x3c]
add r13, r14
mov eax, 0x8664
cmp word [r13 + 4], ax
je 0x18000135d
xor al, al
jmp 0x180001bce
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180007710], rax
test rax, rax
jne 0x18000139c
lea rcx, str.Could_not_find_NtAllocateVirtualMemory_entry_point_in_NTDLL.DLL
call fcn.180001010
xor al, al
jmp 0x180001bce
lea rdx, str.NtFreeVirtualMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800076f8], rax
test rax, rax
jne 0x1800013cb
lea rcx, str.Could_not_find_NtFreeVirtualMemory_entry_point_in_NTDLL.DLL
call fcn.180001010
xor al, al
jmp 0x180001bce
lea rdx, str.NtProtectVirtualMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180007700], rax
test rax, rax
jne 0x1800013fa
lea rcx, str.Could_not_find_NtProtectVirtualMemory_entry_point_in_NTDLL.DLL
call fcn.180001010
xor al, al
jmp 0x180001bce
lea rdx, str.NtWriteVirtualMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800076f0], rax
test rax, rax
jne 0x180001429
lea rcx, str.Could_not_find_NtWriteVirtualMemory_entry_point_in_NTDLL.DLL
call fcn.180001010
xor al, al
jmp 0x180001bce
lea rdx, str.NtFlushInstructionCache
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180007718], rax
test rax, rax
jne 0x180001458
lea rcx, str.Could_not_find_NtFlushInstructionCache_entry_point_in_NTDLL.DLL
call fcn.180001010
xor al, al
jmp 0x180001bce
lea rdx, str.NtCreateThreadEx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x180001483
lea rcx, str.Could_not_find_NtCreateThreadEx_entry_point_in_NTDLL.DLL
call fcn.180001010
xor al, al
jmp 0x180001bce
mov r8d, dword [r13 + 0x50]
mov dword [rsp + 0x20], 4
mov rcx, rbx
call fcn.180001070
mov r12, rax
test rax, rax
je 0x180001bce
xor esi, esi
mov dword [rsp + 0x114], esi
mov r8d, dword [r13 + 0x50]
lea rax, [rsp + 0x114]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x40]
mov rdx, r12
mov rcx, rbx
call fcn.180001140
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x90], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x98], rax
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0xb8], 1
mov qword [rsp + 0xc0], rsi
mov dword [rsp + 0xc8], 1
mov r9d, 0x1000
mov r8, r14
mov rdx, r12
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x180001580
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_write_file_header_0x_X_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001bce
movzx edi, word [r13 + 0x14]
add rdi, 0x18
add rdi, r13
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x60], rdi
movzx eax, word [r13 + 6]
cmp esi, eax
je 0x1800015ef
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x1800015e7
mov r9d, eax
mov r8d, dword [rdi + 0x14]
add r8, r14
mov edx, dword [rdi + 0xc]
add rdx, r12
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x1800015e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_map_sections:_0x_x_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001bce
inc esi
add rdi, 0x28
jmp 0x18000158c
mov dword [rsp + 0x20], 4
mov r8d, 0x40
mov rcx, rbx
call fcn.180001070
mov rsi, rax
mov qword [rsp + 0x80], rax
test rax, rax
jne 0x18000163b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Target_process_mapping_allocation_failed__ex__0x_X_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001bce
mov r9d, 0x40
lea r8, [rsp + 0x90]
mov rdx, rsi
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x180001689
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_write_mapping_0x_X_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
mov rdx, rsi
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001bce
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1000
mov rcx, rbx
call fcn.180001070
mov r14, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x1800016dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Memory_shellcode_allocation_failed__ex__0x_X_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
mov rdx, rsi
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001bce
mov r9d, 0x1000
lea r8, [0x180001c00]
mov rdx, r14
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x180001735
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_write_shellcode_0x_X_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
mov rdx, rsi
mov rcx, rbx
call fcn.1800010e0
mov rdx, r14
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001bce
mov rdx, r12
lea rcx, str.Mapped_DLL_at__p_n
call fcn.180001010
mov rdx, rsi
lea rcx, str.Mapping_info_at__p_n
call fcn.180001010
mov rdx, r14
lea rcx, str.Shell_code_at__p_n
call fcn.180001010
lea rcx, str.Data_allocated_n
call fcn.180001010
xor edi, edi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
mov r9, rbx
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x88]
call r15
mov rcx, qword [rsp + 0x88]
test rcx, rcx
jne 0x1800017f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Thread_creation_failed_0x_X_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
mov rdx, rsi
mov rcx, rbx
call fcn.1800010e0
mov rdx, r14
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001bce
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, r14
lea rcx, str.Thread_created_at:__p__waiting_for_return..._n
call fcn.180001010
xor r15d, r15d
test rdi, rdi
jne 0x180001960
mov dword [rsp + 0x110], r15d
lea rdx, [rsp + 0x110]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rsp + 0x110]
cmp edx, 0x103
je 0x180001855
lea rcx, str.Process_crashed__exit_code:__d_n
call fcn.180001010
xor al, al
jmp 0x180001bce
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
movups xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x120], 0x40
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x1800018f6
lea rdx, str.NtReadVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x1800018bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1800018f6
mov rax, qword [0x180007708]
test rax, rax
cmove rax, rcx
mov qword [0x180007708], rax
lea rcx, [rsp + 0x120]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x120]
lea r8, [rsp + 0xd0]
mov rdx, rsi
mov rcx, rbx
call rax
mov rdi, qword [rsp + 0xf0]
cmp rdi, 0x404040
jne 0x18000193b
lea rcx, str.Wrong_mapping_ptr_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
mov rdx, rsi
mov rcx, rbx
call fcn.1800010e0
mov rdx, r14
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001bce
cmp rdi, 0x505050
jne 0x180001950
lea rcx, str.WARNING:_Exception_support_failed__n
call fcn.180001010
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180001811
mov ecx, 0x1400000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
jne 0x180001986
lea rcx, str.Unable_to_allocate_memory_n
call fcn.180001010
xor al, al
jmp 0x180001bce
xor edx, edx
mov r8d, 0x1400000
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1000
mov r8, r15
mov rdx, r12
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x1800019ba
lea rcx, str.WARNING_:_Cant_clear_HEADER_n
call fcn.180001010
movzx edi, word [r13 + 0x14]
add rdi, 0x18
add rdi, r13
xor esi, esi
lea r14, str..rsrc
lea rdx, str..reloc
mov dword [rsp + 0x6c], esi
mov qword [rsp + 0x60], rdi
movzx eax, word [r13 + 6]
cmp esi, eax
je 0x180001a85
cmp dword [rdi + 8], 0
je 0x180001a7a
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [r14 + rcx - 1]
jne 0x180001a16
cmp rcx, 6
jne 0x180001a00
jmp 0x180001a33
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x180001a7a
cmp rcx, 7
jne 0x180001a20
mov rdx, rdi
lea rcx, str.Processing__s_removal_n
call fcn.180001010
mov r9d, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
add rdx, r12
mov r8, r15
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x180001a73
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, rdi
lea rcx, str.Cant_clear_section__s:_0x_x_n
call fcn.180001010
lea rdx, str..reloc
inc esi
add rdi, 0x28
jmp 0x1800019d6
movzx edi, word [r13 + 0x14]
add rdi, 0x18
add rdi, r13
xor r14d, r14d
lea edx, [r14 + 0x20]
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x60], rdi
movzx eax, word [r13 + 6]
cmp r14d, eax
je 0x180001b2b
mov ecx, dword [rdi + 8]
test ecx, ecx
je 0x180001b1f
mov dword [rsp + 0x118], 0
mov eax, dword [rdi + 0x24]
test eax, 0x80000000
jbe 0x180001acf
mov esi, 4
jmp 0x180001adc
test eax, 0x20000000
mov esi, 2
cmova esi, edx
mov r8, rcx
mov edx, dword [rdi + 0xc]
add rdx, r12
lea rax, [rsp + 0x118]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov rcx, rbx
call fcn.180001140
mov r8d, esi
mov rdx, rdi
test eax, eax
lea rcx, str.section__s_set_as__lX_n
jne 0x180001b15
lea rcx, str.FAIL:_section__s_not_set_as__lX_n
call fcn.180001010
mov edx, 0x20
inc r14d
add rdi, 0x28
jmp 0x180001a98
mov dword [rsp + 0x11c], 0
movzx eax, word [r13 + 0x14]
mov r8d, dword [rax + r13 + 0x24]
lea rax, [rsp + 0x11c]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov rdx, r12
mov rcx, rbx
call fcn.180001140
mov r9d, 0x1000
mov r8, r15
mov rdi, qword [rsp + 0x78]
mov rdx, rdi
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x180001b87
lea rcx, str.WARNING:_Cant_clear_shellcode_n
call fcn.180001010
mov rdx, rdi
mov rcx, rbx
call fcn.1800010e0
test eax, eax
jne 0x180001ba2
lea rcx, str.WARNING:_cant_release_shell_code_memory_n
call fcn.180001010
mov rdx, qword [rsp + 0x80]
mov rcx, rbx
call fcn.1800010e0
test eax, eax
jne 0x180001bc2
lea rcx, str.WARNING:_cant_release_mapping_data_memory_n
call fcn.180001010
mov rcx, r15
call fcn.1800031a0
jmp 0x180001bcc
mov al, 1
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.180003180
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret