Function at 0x1800014c0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x910
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x88], xmm13
mov rax, qword [0x1802080f0]
xor rax, rsp
mov qword [rsp + 0x880], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor edx, edx
mov r8, rax
xor ecx, ecx
call fcn.18000ac00
test eax, eax
jne 0x180001528
lea rcx, str.exit_code
call fcn.18014aadc
xor ebx, ebx
mov edi, ebx
nop dword [rax]
call fcn.18014a880
and eax, 0x800000ff
jge 0x180001545
dec eax
or eax, 0xffffff00
inc eax
mov byte [rsp + rdi + 0xb0], al
inc rdi
cmp rdi, 0x7d0
jl 0x180001530
mov rdi, rbx
nop dword [rax + rax]
movzx ecx, byte [rsp + rdi + 0xb0]
call fcn.180001a20
mov rcx, rax
call fcn.180006730
inc rdi
cmp rdi, 0x7d0
jl 0x180001560
lea rsi, [0x18020a250]
mov dl, 0xa
mov rcx, rsi
call fcn.180008150
mov rax, qword [0x18020a250]
mov edi, ebx
movsxd rcx, dword [rax + 4]
mov r12d, 4
test byte [rcx + rsi + 0x10], 6
jne 0x1800015c5
mov rcx, qword [rcx + rsi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
mov rax, qword [0x18020a250]
cmove edi, r12d
movsxd rcx, dword [rax + 4]
add rcx, rsi
test edi, edi
je 0x1800015e6
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], rbx
jne 0x1800015de
or edx, r12d
xor r8d, r8d
call fcn.180008530
mov rdi, rbx
nop dword [rax]
movzx ecx, byte [rsp + rdi + 0xb0]
call fcn.180001a20
mov rcx, rax
call fcn.180006730
inc rdi
cmp rdi, 0x7d0
jl 0x1800015f0
xor ecx, ecx
call fcn.18014ab88
mov rcx, rax
call fcn.18014a868
call fcn.18014a880
mov edi, eax
mov eax, 0xb60b60b7
imul edi
add edx, edi
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x168
sub edi, edx
movd xmm6, edi
cvtdq2pd xmm6, xmm6
call fcn.18014a880
movsd xmm13, qword [0x1801cd0f0]
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub edi, edx
movd xmm7, edi
cvtdq2pd xmm7, xmm7
addsd xmm7, xmm13
call fcn.18014a880
mov edi, eax
mov eax, 0x10624dd3
movapd xmm0, xmm6
imul edi
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x3e8
sub edi, edx
movd xmm8, edi
cvtdq2pd xmm8, xmm8
addsd xmm8, qword [0x1801cd0f8]
call fcn.180001c10
mov dl, 0xa
mov rcx, rax
mov rsi, rax
call fcn.180008150
mov rcx, qword [rsi]
mov edi, ebx
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x1800016e8
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove edi, r12d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test edi, edi
je 0x18000170c
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], rbx
jne 0x180001704
or edx, r12d
xor r8d, r8d
call fcn.180008530
movapd xmm0, xmm7
call fcn.180001c10
mov dl, 0xa
mov rcx, rax
mov rsi, rax
call fcn.180008150
mov rcx, qword [rsi]
mov edi, ebx
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x180001744
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove edi, r12d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test edi, edi
je 0x180001768
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], rbx
jne 0x180001760
or edx, r12d
xor r8d, r8d
call fcn.180008530
movapd xmm0, xmm8
call fcn.180001c10
mov dl, 0xa
mov rcx, rax
mov rsi, rax
call fcn.180008150
mov rcx, qword [rsi]
mov edi, ebx
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x1800017a1
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove edi, r12d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test edi, edi
je 0x1800017d0
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], rbx
jne 0x1800017bd
or edx, r12d
xor r8d, r8d
call fcn.180008530
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x31]
mov byte [rsp + 0x30], 9
lea r8d, [rdx + 0x7f]
call fcn.18014c9d0
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov rbp, rax
test rax, rax
je 0x180001824
xor edx, edx
mov r8d, 0x1500000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x18000182e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov eax, 1
jmp 0x1800019dd
movaps xmmword [rsp + 0x8d0], xmm9
movaps xmmword [rsp + 0x8c0], xmm10
movaps xmmword [rsp + 0x8b0], xmm11
movaps xmmword [rsp + 0x8a0], xmm12
call fcn.18014a880
and eax, 0x80000001
jge 0x180001865
dec eax
or eax, 0xfffffffe
inc eax
mov byte [rbx + rsi], al
inc rbx
cmp rbx, 0x1500000
jl 0x180001852
movsd xmm7, qword [0x1801cd5b8]
xorpd xmm6, xmm6
mov r9d, r12d
mov edx, 0x26aaa2
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, 0x408
mov r12, rax
call fcn.180008838
or rcx, 0xffffffffffffffff
mov rbx, rax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x30]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.180001010
lea rdx, section.text_1
mov rcx, rbx
call fcn.180001140
movsd xmm9, qword [0x1801cd5b0]
movsd xmm10, qword [0x1801cd5a8]
movsd xmm11, qword [0x1801cd5a0]
movsd xmm8, qword [0x1801cd598]
movsd xmm12, qword [0x1801cd590]
nop word [rax + rax]
movapd xmm0, xmm6
mov eax, 2
movapd xmm1, xmm13
nop
test al, 1
je 0x180001928
mulsd xmm1, xmm0
shr eax, 1
je 0x180001932
mulsd xmm0, xmm0
jmp 0x180001920
mulsd xmm1, xmm9
xor ecx, ecx
subsd xmm1, xmm10
divsd xmm1, xmm11
mulsd xmm1, xmm8
addsd xmm6, xmm1
movapd xmm0, xmm6
mulsd xmm0, xmm8
subsd xmm7, xmm0
call fcn.18014ab88
mov rcx, rax
call fcn.18014a868
lea rdx, [0x180416480]
mov r8d, 0x82622
mov rcx, r12
call fcn.18014ac20
lea r9, [rsp + 0x20]
mov edx, 0x26aaa2
mov r8d, 0x40
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
call r12
comisd xmm7, xmm12
ja 0x180001910
movaps xmm12, xmmword [rsp + 0x8a0]
movaps xmm11, xmmword [rsp + 0x8b0]
movaps xmm10, xmmword [rsp + 0x8c0]
movaps xmm9, xmmword [rsp + 0x8d0]
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.18014a6e0
lea r11, [rsp + 0x910]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop r12
ret