Function at 0x655540
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
mov qword [rbp + 0x80], r8
mov qword [rbp + 0x58], 0
mov ecx, 0x30
mov rdx, qword [0x00654c78]
call fcn.004117c0
mov qword [rbp + 0x38], rax
mov rcx, qword [rbp + 0x38]
mov edx, 0x30
xor r8, r8
call fcn.00408d50
mov rax, qword [rbp + 0x38]
mov dword [rax + 0x2c], 0x19770605
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x50]
cmp word [rax], 0x5a4d
je 0x6555d2
mov rcx, qword [rbp + 0x38]
mov rdx, qword [0x00654c78]
call fcn.004117f0
lea rcx, [0x0065588c]
call fcn.00654cb0
jmp 0x65585d
mov rax, qword [rbp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x40]
add rcx, rax
mov qword [rbp + 0x48], rcx
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x4550
je 0x655612
mov rcx, qword [rbp + 0x38]
mov rdx, qword [0x00654c78]
call fcn.004117f0
lea rcx, [0x006558fc]
call fcn.00654cb0
jmp 0x65585d
mov rax, qword [rbp + 0x48]
cmp word [rax + 4], 0x8664
je 0x65563f
mov rcx, qword [rbp + 0x38]
mov rdx, qword [0x00654c78]
call fcn.004117f0
lea rcx, [0x00655968]
call fcn.00654cb0
jmp 0x65585d
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x30]
mov rax, qword [rbp + 0x48]
mov edx, dword [rax + 0x50]
mov r8d, 0x3000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov rcx, qword [rbp + 0x38]
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x38]
cmp qword [rax + 8], 0
jne 0x655699
xor rcx, rcx
mov rax, qword [rbp + 0x48]
mov edx, dword [rax + 0x50]
mov r8d, 0x2000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov rcx, qword [rbp + 0x38]
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x38]
cmp qword [rax + 8], 0
jne 0x6556c5
mov rcx, qword [rbp + 0x38]
mov rdx, qword [0x00654c78]
call fcn.004117f0
lea rcx, [0x006559a0]
call fcn.00654cb0
jmp 0x65585d
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax + 8]
mov rax, qword [rbp + 0x48]
mov edx, dword [rax + 0x50]
mov r8d, 0x1000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax + 8]
mov rax, qword [rbp + 0x48]
mov edx, dword [rax + 0x54]
mov r8d, 0x1000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x50]
movsxd rdx, dword [rdx + 0x3c]
mov rcx, qword [rcx + 8]
add rcx, rdx
mov qword [rax], rcx
mov rcx, qword [rbp + 0x50]
mov rax, qword [rbp + 0x38]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0x48]
mov r8d, dword [rax + 0x54]
call fcn.00406200
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x50]
movsxd rdx, dword [rdx + 0x3c]
mov rcx, qword [rcx + 8]
add rcx, rdx
mov qword [rax], rcx
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x38]
mov ecx, dword [rcx + 8]
mov qword [rax + 0x30], rcx
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x38]
call fcn.00654cd0
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rax + 8]
sub rax, qword [rcx + 0x30]
mov qword [rbp + 0x30], rax
cmp qword [rbp + 0x30], 0
je 0x6557a1
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.00655060
mov rcx, qword [rbp + 0x38]
call fcn.00655400
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x78]
mov r8, qword [rbp + 0x80]
call fcn.00654de0
test al, al
jne 0x6557d0
lea rcx, [rbp + 0x38]
call fcn.00655bf0
jmp 0x65585d
mov rcx, qword [rbp + 0x38]
call fcn.006552c0
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
cmp dword [rax + 0x28], 0
je 0x655855
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x38]
mov rdx, qword [rdx]
mov edx, dword [rdx + 0x28]
mov rcx, qword [rcx + 8]
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x38]
cmp qword [rax + 0x10], 0
je 0x655842
nop
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax + 8]
mov edx, 1
xor r8, r8
mov rax, qword [rbp + 0x38]
call qword [rax + 0x10]
test eax, eax
jne 0x65584d
lea rcx, [rbp + 0x38]
call fcn.00655bf0
jmp 0x65585d
lea rcx, [rbp + 0x38]
call fcn.00655bf0
jmp 0x65585d
mov rax, qword [rbp + 0x38]
mov byte [rax + 0x28], 1
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
lea rsp, [rbp + 0x60]
pop rbp
ret