Function at 0x140001860
Capabilities:
Allocate or change rwx memory
Check for debugger via api
Enumerate pe sections
Execute shellcode via indirect call
Link many functions at runtime
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x140001d30
mov rdi, rcx
movsxd r12, dword [rcx + 0x3c]
cmp dword [rcx + r12], 0x4550
jne 0x140001d30
lea rdx, [rsp + 0x58]
mov r8d, 0x30
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov r14d, eax
mov dword [rsp + 0x28], 0
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov esi, dword [rsp + 0x28]
lea rcx, [0x1400061ef]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400061f9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call r15
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov rcx, rax
mov edx, 7
mov r9d, 8
call rbx
test eax, eax
setns al
cmp qword [rsp + 0x28], 0
setne cl
or esi, r14d
jne 0x140001f6f
and al, cl
jne 0x140001f6f
cmp dword [rsp + 0x78], 0x10000
je 0x140001a90
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov r14d, eax
mov dword [rsp + 0x28], 0
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov esi, dword [rsp + 0x28]
lea rcx, [0x1400061ef]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400061f9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call r15
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov rcx, rax
mov edx, 7
mov r9d, 8
call rbx
test eax, eax
setns al
cmp qword [rsp + 0x28], 0
setne cl
or esi, r14d
jne 0x140001f6f
and al, cl
jne 0x140001f6f
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov esi, eax
test ebx, ebx
mov dword [rsp + 0x28], 0
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov r14d, dword [rsp + 0x28]
lea rcx, [0x1400061ef]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400061f9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call r15
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov rcx, rax
mov edx, 7
mov r9d, 8
call rbx
test eax, eax
setns al
cmp qword [rsp + 0x28], 0
setne cl
or esi, r14d
jne 0x140001f6f
and al, cl
jne 0x140001f6f
add r12, rdi
mov edx, dword [r12 + 0x50]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov esi, eax
test rbp, rbp
je 0x140001ca6
mov dword [rsp + 0x28], 0
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov r14d, dword [rsp + 0x28]
lea rcx, [0x1400061ef]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400061f9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call r15
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov rcx, rax
mov edx, 7
mov r9d, 8
call rbx
test eax, eax
setns al
cmp qword [rsp + 0x28], 0
setne cl
or esi, r14d
jne 0x140001f6f
and al, cl
jne 0x140001f6f
mov r8d, dword [r12 + 0x54]
mov rcx, rbp
mov rdx, rdi
call sub.ntdll.dll_memcpy
cmp word [r12 + 6], 0
je 0x140001ba7
movzx eax, word [r12 + 0x14]
lea rsi, [r12 + rax]
add rsi, 0x18
add rsi, 0x14
xor ebx, ebx
nop dword [rax + rax]
mov ecx, dword [rsi - 8]
mov r8d, dword [rsi - 4]
add rcx, rbp
mov edx, dword [rsi]
add rdx, rdi
call sub.ntdll.dll_memcpy
add rbx, 1
movzx eax, word [r12 + 6]
add rsi, 0x28
cmp rbx, rax
jb 0x140001b80
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], r12
cmp dword [r12 + 0xb4], 0
je 0x140001d52
mov rax, qword [rsp + 0x38]
mov edi, dword [rax + 0xb0]
mov rax, qword [rsp + 0x30]
mov eax, dword [rdi + rax + 4]
test eax, eax
je 0x140001d52
mov rdx, qword [rsp + 0x30]
mov r13, rdx
mov rcx, qword [rsp + 0x38]
sub r13, qword [rcx + 0x30]
lea r12, [rdi + rdx]
add r12, 4
add rdi, rdx
movabs rdx, 0x1fffffff8
lea r15, str.entry:__llu_n
jmp 0x140001c30
mov ecx, dword [r12]
movabs rdx, 0x1fffffff8
lea r12, [rdi + rcx]
add r12, 4
mov eax, dword [rdi + rcx + 4]
add rdi, rcx
test eax, eax
je 0x140001d52
mov ecx, eax
lea rax, [rcx + rdx]
shr rax, 1
test eax, eax
je 0x140001c19
mov esi, eax
xor ebp, ebp
jmp 0x140001c60
add rax, r13
mov qword [r14 + rbx], rax
add rbp, 1
cmp rsi, rbp
je 0x140001c0b
movzx ebx, word [rdi + rbp*2 + 8]
mov edx, ebx
shr edx, 0xc
test dx, dx
je 0x140001c57
cmp dx, 0xa
jne 0x140001d46
and ebx, 0xfff
mov r14d, dword [rdi]
add rbx, qword [rsp + 0x30]
mov rax, qword [r14 + rbx]
cmp rax, 0x5f6e0
jne 0x140001c50
mov edx, 0x5f6e0
mov rcx, r15
call sub.msvcrt.dll_printf
mov rax, qword [r14 + rbx]
jmp 0x140001c50
mov dword [rsp + 0x28], 0
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rbp
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ebx, dword [rsp + 0x28]
lea rcx, [0x1400061ef]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400061f9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call rbp
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov rcx, rax
mov edx, 7
mov r9d, 8
call rdi
test eax, eax
setns al
cmp qword [rsp + 0x28], 0
setne cl
or esi, ebx
jne 0x140001f6f
and al, cl
jne 0x140001f6f
xor eax, eax
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.Error:_Unsupported_relocation_type__u_n
call sub.msvcrt.dll_printf
mov rax, qword [rsp + 0x38]
mov esi, dword [rax + 0x90]
mov rdi, qword [rsp + 0x30]
mov r12d, dword [rdi + rsi + 0xc]
test r12d, r12d
je 0x140001f36
add rsi, rdi
lea rax, [rdi + 2]
mov qword [rsp + 0x50], rax
jmp 0x140001d9b
mov rsi, qword [rsp + 0x40]
mov r12d, dword [rsi + 0x20]
add rsi, 0x14
test r12d, r12d
mov rdi, qword [rsp + 0x30]
je 0x140001f36
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov r15d, eax
mov dword [rsp + 0x28], 0
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r14
mov rcx, rax
lea r13, [rsp + 0x28]
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ebx, dword [rsp + 0x28]
lea rcx, [0x1400061ef]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400061f9]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
call r14
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 7
mov r8, r13
mov r9d, 8
call rbp
test eax, eax
setns al
cmp qword [rsp + 0x28], 0
setne cl
or ebx, r15d
jne 0x140001f6f
and al, cl
jne 0x140001f6f
mov ecx, r12d
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov r15d, dword [rsi]
mov rdx, qword [rdi + r15]
test rdx, rdx
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x140001d80
mov rax, qword [rsp + 0x40]
mov r12d, dword [rax + 0x10]
mov r13, qword [rsp + 0x30]
nop dword [rax]
test rdx, rdx
js 0x140001e80
add rdx, qword [rsp + 0x50]
jmp 0x140001e83
movzx edx, dx
mov rcx, qword [rsp + 0x48]
call rsi
mov qword [r13 + r12], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebp, eax
mov dword [rsp + 0x28], 0
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rdi
mov rcx, rax
lea rbx, [rsp + 0x28]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov r14d, dword [rsp + 0x28]
lea rcx, [0x1400061ef]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400061f9]
call rsi
mov rsi, rax
call rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 7
mov r8, rbx
mov r9d, 8
call rsi
test eax, eax
setns al
cmp qword [rsp + 0x28], 0
setne cl
or r14d, ebp
jne 0x140001f6f
and al, cl
jne 0x140001f6f
mov rdx, qword [r13 + r15 + 8]
add r13, 8
test rdx, rdx
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x140001e70
jmp 0x140001d80
mov ecx, 0x18
call sub.msvcrt.dll_malloc
mov qword [rax], rdi
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rdx + 0x50]
mov dword [rax + 0x10], ecx
mov qword [rax + 8], 0
test byte [rdx + 0x16], 2
je 0x140001d32
mov ecx, dword [rdx + 0x28]
add rdi, rcx
mov qword [rax + 8], rdi
jmp 0x140001d32
mov ecx, 0x1f5
call sub.msvcrt.dll_exit
int3