Function at 0x180001300
Capabilities:
Enumerate pe sections
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x180007008]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r14, rdx
mov rbx, rcx
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x180001343
xor al, al
jmp 0x180001b6e
movsxd r13, dword [rdx + 0x3c]
add r13, r14
mov eax, 0x8664
cmp word [r13 + 4], ax
je 0x18000135d
xor al, al
jmp 0x180001b6e
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180007708], rax
test rax, rax
jne 0x18000139c
lea rcx, str.Could_not_find_NtAllocateVirtualMemory_entry_point_in_NTDLL.DLL
call fcn.180001010
xor al, al
jmp 0x180001b6e
lea rdx, str.NtFreeVirtualMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800076f8], rax
test rax, rax
jne 0x1800013cb
lea rcx, str.Could_not_find_NtFreeVirtualMemory_entry_point_in_NTDLL.DLL
call fcn.180001010
xor al, al
jmp 0x180001b6e
lea rdx, str.NtProtectVirtualMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180007700], rax
test rax, rax
jne 0x1800013fa
lea rcx, str.Could_not_find_NtProtectVirtualMemory_entry_point_in_NTDLL.DLL
call fcn.180001010
xor al, al
jmp 0x180001b6e
lea rdx, str.NtWriteVirtualMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800076f0], rax
test rax, rax
jne 0x180001429
lea rcx, str.Could_not_find_NtWriteVirtualMemory_entry_point_in_NTDLL.DLL
call fcn.180001010
xor al, al
jmp 0x180001b6e
lea rdx, str.NtFlushInstructionCache
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180007710], rax
test rax, rax
jne 0x180001458
lea rcx, str.Could_not_find_NtFlushInstructionCache_entry_point_in_NTDLL.DLL
call fcn.180001010
xor al, al
jmp 0x180001b6e
lea rdx, str.NtCreateThreadEx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x180001483
lea rcx, str.Could_not_find_NtCreateThreadEx_entry_point_in_NTDLL.DLL
call fcn.180001010
xor al, al
jmp 0x180001b6e
mov r8d, dword [r13 + 0x50]
mov dword [rsp + 0x20], 4
mov rcx, rbx
call fcn.180001070
mov r12, rax
test rax, rax
je 0x180001b6e
xor esi, esi
mov dword [rsp + 0x114], esi
mov r8d, dword [r13 + 0x50]
lea rax, [rsp + 0x114]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x40]
mov rdx, r12
mov rcx, rbx
call fcn.180001140
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x90], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x98], rax
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0xb8], 1
mov qword [rsp + 0xc0], rsi
mov dword [rsp + 0xc8], 1
mov r9d, 0x1000
mov r8, r14
mov rdx, r12
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x180001580
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_write_file_header_0x_X_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001b6e
movzx edi, word [r13 + 0x14]
add rdi, 0x18
add rdi, r13
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x60], rdi
movzx eax, word [r13 + 6]
cmp esi, eax
je 0x1800015ef
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x1800015e7
mov r9d, eax
mov r8d, dword [rdi + 0x14]
add r8, r14
mov edx, dword [rdi + 0xc]
add rdx, r12
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x1800015e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_map_sections:_0x_x_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001b6e
inc esi
add rdi, 0x28
jmp 0x18000158c
mov dword [rsp + 0x20], 4
mov r8d, 0x40
mov rcx, rbx
call fcn.180001070
mov rsi, rax
mov qword [rsp + 0x80], rax
test rax, rax
jne 0x18000163b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Target_process_mapping_allocation_failed__ex__0x_X_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001b6e
mov r9d, 0x40
lea r8, [rsp + 0x90]
mov rdx, rsi
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x180001689
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_write_mapping_0x_X_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
mov rdx, rsi
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001b6e
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1000
mov rcx, rbx
call fcn.180001070
mov r14, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x1800016dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Memory_shellcode_allocation_failed__ex__0x_X_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
mov rdx, rsi
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001b6e
mov r9d, 0x1000
lea r8, [0x180001ba0]
mov rdx, r14
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x180001735
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_write_shellcode_0x_X_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
mov rdx, rsi
mov rcx, rbx
call fcn.1800010e0
mov rdx, r14
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001b6e
mov rdx, r12
lea rcx, str.Mapped_DLL_at__p_n
call fcn.180001010
mov rdx, rsi
lea rcx, str.Mapping_info_at__p_n
call fcn.180001010
mov rdx, r14
lea rcx, str.Shell_code_at__p_n
call fcn.180001010
lea rcx, str.Data_allocated_n
call fcn.180001010
xor eax, eax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
mov r9, rbx
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x88]
call r15
mov rcx, qword [rsp + 0x88]
test rcx, rcx
jne 0x1800017f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Thread_creation_failed_0x_X_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
mov rdx, rsi
mov rcx, rbx
call fcn.1800010e0
mov rdx, r14
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001b6e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, r14
lea rcx, str.Thread_created_at:__p__waiting_for_return..._n
call fcn.180001010
xor r15d, r15d
mov edi, r15d
test rdi, rdi
jne 0x180001904
mov dword [rsp + 0x110], r15d
lea rdx, [rsp + 0x110]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rsp + 0x110]
cmp edx, 0x103
je 0x180001858
lea rcx, str.Process_crashed__exit_code:__d_n
call fcn.180001010
xor al, al
jmp 0x180001b6e
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
movups xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x20], r15
mov r9d, 0x40
lea r8, [rsp + 0xd0]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rsp + 0xf0]
cmp rdi, 0x404040
jne 0x1800018df
lea rcx, str.Wrong_mapping_ptr_n
call fcn.180001010
mov rdx, r12
mov rcx, rbx
call fcn.1800010e0
mov rdx, rsi
mov rcx, rbx
call fcn.1800010e0
mov rdx, r14
mov rcx, rbx
call fcn.1800010e0
xor al, al
jmp 0x180001b6e
cmp rdi, 0x505050
jne 0x1800018f4
lea rcx, str.WARNING:_Exception_support_failed__n
call fcn.180001010
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180001814
mov ecx, 0x1400000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
jne 0x18000192a
lea rcx, str.Unable_to_allocate_memory_n
call fcn.180001010
xor al, al
jmp 0x180001b6e
xor edx, edx
mov r8d, 0x1400000
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1000
mov r8, r15
mov rdx, r12
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x18000195e
lea rcx, str.WARNING_:_Cant_clear_HEADER_n
call fcn.180001010
movzx edi, word [r13 + 0x14]
add rdi, 0x18
add rdi, r13
xor esi, esi
lea r14, str..rsrc
lea rdx, str..reloc
mov dword [rsp + 0x6c], esi
mov qword [rsp + 0x60], rdi
movzx eax, word [r13 + 6]
cmp esi, eax
je 0x180001a25
cmp dword [rdi + 8], 0
je 0x180001a1a
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [r14 + rcx - 1]
jne 0x1800019b6
cmp rcx, 6
jne 0x1800019a0
jmp 0x1800019d3
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x180001a1a
cmp rcx, 7
jne 0x1800019c0
mov rdx, rdi
lea rcx, str.Processing__s_removal_n
call fcn.180001010
mov r9d, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
add rdx, r12
mov r8, r15
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x180001a13
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, rdi
lea rcx, str.Cant_clear_section__s:_0x_x_n
call fcn.180001010
lea rdx, str..reloc
inc esi
add rdi, 0x28
jmp 0x18000197a
movzx edi, word [r13 + 0x14]
add rdi, 0x18
add rdi, r13
xor r14d, r14d
lea edx, [r14 + 0x20]
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x60], rdi
movzx eax, word [r13 + 6]
cmp r14d, eax
je 0x180001acb
mov ecx, dword [rdi + 8]
test ecx, ecx
je 0x180001abf
mov dword [rsp + 0x118], 0
mov eax, dword [rdi + 0x24]
test eax, 0x80000000
jbe 0x180001a6f
mov esi, 4
jmp 0x180001a7c
test eax, 0x20000000
mov esi, 2
cmova esi, edx
mov r8, rcx
mov edx, dword [rdi + 0xc]
add rdx, r12
lea rax, [rsp + 0x118]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov rcx, rbx
call fcn.180001140
mov r8d, esi
mov rdx, rdi
test eax, eax
lea rcx, str.section__s_set_as__lX_n
jne 0x180001ab5
lea rcx, str.FAIL:_section__s_not_set_as__lX_n
call fcn.180001010
mov edx, 0x20
inc r14d
add rdi, 0x28
jmp 0x180001a38
mov dword [rsp + 0x11c], 0
movzx eax, word [r13 + 0x14]
mov r8d, dword [rax + r13 + 0x24]
lea rax, [rsp + 0x11c]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov rdx, r12
mov rcx, rbx
call fcn.180001140
mov r9d, 0x1000
mov r8, r15
mov rdi, qword [rsp + 0x78]
mov rdx, rdi
mov rcx, rbx
call fcn.1800011a0
test eax, eax
jne 0x180001b27
lea rcx, str.WARNING:_Cant_clear_shellcode_n
call fcn.180001010
mov rdx, rdi
mov rcx, rbx
call fcn.1800010e0
test eax, eax
jne 0x180001b42
lea rcx, str.WARNING:_cant_release_shell_code_memory_n
call fcn.180001010
mov rdx, qword [rsp + 0x80]
mov rcx, rbx
call fcn.1800010e0
test eax, eax
jne 0x180001b62
lea rcx, str.WARNING:_cant_release_mapping_data_memory_n
call fcn.180001010
mov rcx, r15
call fcn.1800030b0
jmp 0x180001b6c
mov al, 1
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180003090
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret