Function at 0x140001410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
pause
pause
pause
nop
nop
nop
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x140001524
mov rsi, rcx
nop
nop
nop
movsxd r14, dword [rcx + 0x3c]
cmp dword [rcx + r14], 0x4550
jne 0x140001537
nop
nop
nop
mov edx, dword [rsi + r14 + 0x50]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1400015e6
mov rdi, rax
nop
nop
nop
mov r8d, dword [rsi + r14 + 0x54]
mov rcx, rax
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
nop
nop
nop
cmp word [rsi + r14 + 6], 0
je 0x1400014d6
lea rbx, [r14 + rsi]
add rbx, 0x11c
xor r15d, r15d
nop word cs:[rax + rax]
mov ecx, dword [rbx - 8]
mov r8d, dword [rbx - 4]
add rcx, rdi
mov edx, dword [rbx]
add rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
inc r15
movzx eax, word [rsi + r14 + 6]
add rbx, 0x28
cmp r15, rax
jb 0x1400014b0
nop
nop
nop
mov eax, dword [rsi + r14 + 0x94]
nop
nop
nop
test eax, eax
je 0x1400015c0
mov eax, dword [rsi + r14 + 0x90]
nop
nop
nop
nop
nop
nop
cmp dword [rdi + rax + 0xc], 0
je 0x1400015c0
lea r15, [rdi + rax]
add rax, rdi
add rax, 0xc
lea r12, [rdi + 2]
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140001560
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x1400033eb]
jmp 0x140001604
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x1400033d5]
jmp 0x140001604
lea rax, [r15 + 0x20]
cmp dword [r15 + 0x20], 0
lea r15, [r15 + 0x14]
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
je 0x1400015c0
nop
nop
nop
mov ecx, dword [rax]
add rcx, rdi
nop
nop
nop
call rdx
nop
nop
nop
test rax, rax
je 0x140001645
nop
nop
nop
mov r13d, dword [r15 + 0x10]
nop
nop
nop
cmp qword [rdi + r13], 0
je 0x14000154a
mov rbx, rax
add r13, rdi
nop
nop
nop
mov rdx, qword [r13]
add rdx, r12
nop
nop
nop
mov rcx, rbx
call rbp
mov qword [r13], rax
nop
nop
nop
cmp qword [r13], 0
je 0x1400015f6
nop
nop
nop
cmp qword [r13 + 8], 0
lea r13, [r13 + 8]
jne 0x140001590
jmp 0x14000154a
nop
nop
nop
mov eax, dword [rsi + r14 + 0x28]
mov r9, rdi
add r9, rax
nop
nop
nop
mov rcx, rdi
mov edx, 1
xor r8d, r8d
call r9
nop
nop
nop
mov al, 1
jmp 0x140001634
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x1400034c1]
jmp 0x140001604
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140003445]
call fcn.1400011a0
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140003402]
jmp 0x140001604