Function at 0x180003728
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x70
mov r13, rcx
xor r11d, r11d
mov r12d, 0xc1
mov dword [rax - 0x68], r12d
mov rbx, r11
mov r14d, r11d
cmp edx, 0x800
jb 0x180003a05
call fcn.1800036f0
xor r11d, r11d
cmp eax, r11d
je 0x180003a05
movsxd r15, dword [r13 + 0x3c]
add r15, r13
mov qword [rsp + 0x50], r15
mov r14d, dword [r15 + 0x50]
mov dword [rsp + 0x2c], r14d
lea r9d, [rbx + 0x40]
mov r8d, 0x3000
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x60], rax
xor r11d, r11d
cmp rax, r11
jne 0x1800037c0
lea r12d, [r11 + 8]
mov dword [rsp + 0x20], r12d
jmp 0x180003a0f
mov rdi, rax
xor eax, eax
mov rcx, r14
rep stosb byte [rdi], al
movsxd r9, dword [r13 + 0x3c]
add r9, r13
movzx eax, word [r9 + 0x14]
lea r10, [rax + r9 + 0x18]
mov ecx, dword [r10 + 0x14]
mov rdi, rbx
mov rsi, r13
rep movsb byte [rdi], byte [rsi]
mov r8d, r11d
mov dword [rsp + 0x24], r11d
movzx eax, word [r9 + 6]
cmp r8d, eax
jge 0x180003821
movsxd rax, r8d
lea rdx, [rax + rax*4]
mov ecx, dword [r10 + rdx*8 + 0x10]
mov esi, dword [r10 + rdx*8 + 0x14]
add rsi, r13
mov edi, dword [r10 + rdx*8 + 0xc]
add rdi, rbx
rep movsb byte [rdi], byte [rsi]
inc r8d
mov dword [rsp + 0x24], r8d
jmp 0x1800037ef
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0xb0]
cmp ecx, r11d
je 0x1800038aa
cmp dword [rax + rbx + 0xb4], r11d
je 0x1800038aa
lea rdx, [rbx + rcx]
mov qword [rsp + 0x30], rdx
mov rsi, rbx
sub rsi, qword [rax + rbx + 0x30]
je 0x1800038aa
cmp dword [rdx + 4], r11d
je 0x1800038aa
mov edi, r11d
mov dword [rsp + 0x28], r11d
mov ecx, edi
mov eax, dword [rdx + 4]
sub rax, 8
shr rax, 1
cmp rcx, rax
jae 0x18000389d
movzx eax, word [rdx + rcx*2 + 8]
shr ax, 0xc
cmp ax, 3
je 0x180003882
cmp ax, 0xa
jne 0x180003895
movzx eax, word [rdx + rcx*2 + 8]
and eax, 0xfff
mov ecx, dword [rdx]
add rax, rbx
add qword [rcx + rax], rsi
inc edi
mov dword [rsp + 0x28], edi
jmp 0x18000385c
mov eax, dword [rdx + 4]
add rdx, rax
mov qword [rsp + 0x30], rdx
jmp 0x18000384e
mov esi, r11d
mov dword [rsp + 0x58], r11d
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x90]
cmp ecx, r11d
je 0x1800039c3
cmp dword [rax + rbx + 0x94], r11d
je 0x1800039c3
lea rdi, [rbx + rcx]
mov qword [rsp + 0x40], rdi
cmp dword [rdi + 0x10], r11d
je 0x1800039b9
mov ecx, dword [rdi + 0xc]
add rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
xor r11d, r11d
cmp rax, r11
jne 0x18000390e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor r11d, r11d
jmp 0x1800039b9
mov eax, dword [rdi]
cmp eax, r11d
jne 0x180003918
mov eax, dword [rdi + 0x10]
mov r14d, eax
add r14, rbx
mov qword [rsp + 0x48], r14
mov r13d, dword [rdi + 0x10]
add r13, rbx
mov qword [rsp + 0x38], r13
mov rax, qword [r14]
cmp rax, r11
je 0x1800039a6
movabs rcx, 0x8000000000000000
test rcx, rax
je 0x18000396b
movzx edx, ax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13], rax
xor r11d, r11d
cmp rax, r11
jne 0x180003992
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor r11d, r11d
jmp 0x1800039a6
lea rdx, [rax + rbx + 2]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r13], rax
xor r11d, r11d
cmp rax, r11
jne 0x180003992
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor r11d, r11d
jmp 0x1800039a6
add r14, 8
mov qword [rsp + 0x48], r14
add r13, 8
mov qword [rsp + 0x38], r13
jmp 0x18000392f
cmp esi, r11d
jne 0x1800039b9
add rdi, 0x14
mov qword [rsp + 0x40], rdi
jmp 0x1800038dd
mov r14d, dword [rsp + 0x2c]
mov r15, qword [rsp + 0x50]
cmp esi, r11d
jne 0x180003a05
mov edi, dword [r15 + 0x28]
add rdi, rbx
xor r8d, r8d
xor edx, edx
or r12, 0xffffffffffffffff
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor r8d, r8d
lea edx, [r12 + 2]
mov rcx, rbx
call rdi
xor r11d, r11d
cmp eax, r11d
je 0x180003a00
mov r12d, r11d
mov dword [rsp + 0x20], r11d
jmp 0x180003a0a
mov dword [rsp + 0x20], r12d
cmp r12d, r11d
jne 0x180003a0f
cmp r11d, r11d
je 0x180003a2f
cmp rbx, r11
je 0x180003a2f
mov ecx, r14d
mov rdi, rbx
xor eax, eax
rep stosb byte [rdi], al
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x180003a36
mov eax, r12d
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret