Function at 0x14000b340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r8d, edx
mov rbp, rcx
test rcx, rcx
je 0x14000b719
cmp r8d, 0x40
jb 0x14000b719
mov eax, 0x5a4d
cmp ax, word [rcx]
jne 0x14000b719
movsxd r10, dword [rcx + 0x3c]
lea rcx, [r10 + 0x108]
cmp r8, rcx
jb 0x14000b719
cmp dword [r10 + rbp], 0x4550
jne 0x14000b719
mov eax, 0x8664
cmp ax, word [r10 + rbp + 4]
jne 0x14000b719
test byte [r10 + rbp + 0x16], 2
je 0x14000b719
movzx eax, word [r10 + rbp + 0x14]
mov ecx, 0xf0
cmp ax, cx
jb 0x14000b719
movzx r9d, word [r10 + rbp + 6]
lea r14, [rbp + 0x108]
sub ax, cx
xor esi, esi
movzx r12d, ax
movzx edx, si
lea rax, [r12 + r10]
add r14, rax
cmp si, r9w
jae 0x14000b473
nop dword [rax]
movzx eax, dx
lea rcx, [rax + rax*4]
mov eax, dword [r14 + rcx*8 + 0x14]
add eax, dword [r14 + rcx*8 + 0x10]
cmp eax, r8d
ja 0x14000b719
inc dx
cmp dx, r9w
jb 0x14000b400
mov r11d, dword [r10 + rbp + 0x38]
lea r13, [r10 + rbp]
mov ecx, dword [r13 + 0x50]
lea r10, [r14 + 8]
nop dword [rax]
nop dword [rax + rax]
mov r8d, ecx
mov ecx, dword [r10 + 8]
cmp ecx, dword [r10]
cmovbe ecx, dword [r10]
xor edx, edx
dec ecx
add ecx, dword [r10 + 4]
lea r10, [r10 + 0x28]
add ecx, r11d
mov eax, ecx
div r11d
sub ecx, edx
cmp r8d, ecx
cmova ecx, r8d
sub r9, 1
jne 0x14000b440
jmp 0x14000b47c
mov ecx, dword [r10 + rbp + 0x50]
lea r13, [r10 + rbp]
test ecx, ecx
je 0x14000b719
mov r15d, ecx
mov r9d, 0x40
mov rcx, qword [r13 + 0x30]
mov r8d, 0x3000
lea rdx, [r15 + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x14000b4cb
lea r9d, [rax + 0x40]
mov r8d, 0x3000
lea rdx, [r15 + 0x28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14000b719
movzx eax, word [r13 + 6]
movsxd rcx, dword [rbp + 0x3c]
add rcx, r12
lea rdx, [rax*4 + 0x21]
add rdx, rax
lea r8, [rcx + rdx*8]
mov rdx, rbp
mov rcx, rbx
call fcn.1401c5b30
movzx edi, si
cmp si, word [r13 + 6]
jae 0x14000b537
nop dword [rax + rax]
movzx eax, di
lea rcx, [rax + rax*4]
mov edx, dword [r14 + rcx*8 + 0x10]
test edx, edx
je 0x14000b52d
mov eax, dword [r14 + rcx*8 + 0xc]
test eax, eax
je 0x14000b52d
mov r8d, edx
mov edx, dword [r14 + rcx*8 + 0x14]
add rdx, rbp
lea rcx, [rbx + rax]
call fcn.1401c5b30
inc di
cmp di, word [r13 + 6]
jb 0x14000b500
add r15, rbx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [r15 + 0x20], rsi
mov qword [r15 + 0x18], rsi
mov dword [r15 + 0x10], esi
mov qword [r15 + 8], rsi
mov dword [r15], esi
call fcn.1401ca000
mov r14, rax
test rax, rax
je 0x14000b708
movsxd rcx, dword [rbx + 0x3c]
mov r11, rbx
mov qword [rax + 8], rbx
sub r11, qword [rcx + rbx + 0x30]
je 0x14000b61e
cmp dword [rcx + rbx + 0xb4], esi
je 0x14000b61e
mov edi, dword [rcx + rbx + 0xb0]
lea rcx, [rbx + rdi]
mov r9, rcx
cmp dword [rcx], esi
je 0x14000b61e
mov ebp, 3
lea r12d, [rbp + 7]
nop word [rax + rax]
mov r10d, dword [r9 + 4]
mov edx, esi
sub r10, 8
shr r10, 1
test r10d, r10d
je 0x14000b60e
lea r8, [rcx + 8]
nop word [rax + rax]
movzx ecx, word [r8]
movzx eax, cx
shr ax, 0xc
cmp r12w, ax
je 0x14000b5e6
cmp bp, ax
jne 0x14000b5fa
mov rax, rcx
mov ecx, dword [r9]
and eax, 0xfff
add rax, rbx
add qword [rcx + rax], r11
jmp 0x14000b603
cmp si, ax
jne 0x14000b700
inc edx
add r8, 2
cmp edx, r10d
jb 0x14000b5d0
add edi, dword [r9 + 4]
mov ecx, edi
add rcx, rbx
mov r9, rcx
cmp dword [rcx], esi
jne 0x14000b5b0
mov rdx, rbx
mov rcx, r15
call fcn.14000b030
test eax, eax
je 0x14000b700
mov edi, 1
nop word [rax + rax]
xor eax, eax
lock cmpxchg dword [0x14029bfe0], edi
jne 0x14000b640
mov rax, qword [0x14029bff0]
inc dword [0x14029bfe8]
mov qword [r14], rax
mov eax, esi
mov qword [0x14029bff0], r14
xchg dword [0x14029bfe0], eax
movzx ecx, word [r13 + 0x16]
mov eax, 0x2000
and cx, ax
cmp si, cx
je 0x14000b738
mov eax, dword [r13 + 0x28]
test eax, eax
je 0x14000b738
add rax, rbx
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call rax
test eax, eax
jne 0x14000b738
xor eax, eax
lock cmpxchg dword [0x14029bfe0], edi
jne 0x14000b6a2
mov rax, qword [0x14029bff0]
mov rdx, rsi
test rax, rax
je 0x14000b6ec
nop dword [rax]
mov rcx, qword [rax]
cmp rax, r14
je 0x14000b6d5
mov rdx, rax
mov rax, rcx
test rcx, rcx
jne 0x14000b6c0
jmp 0x14000b6ec
test rdx, rdx
jne 0x14000b6e3
mov qword [0x14029bff0], rcx
jmp 0x14000b6e6
mov qword [rdx], rcx
dec dword [0x14029bfe8]
xchg dword [0x14029bfe0], esi
xor r8d, r8d
mov rdx, rbx
mov rcx, r15
call fcn.14000b1f0
mov rcx, r14
call fcn.1401c9f50
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rbx
jmp 0x14000b71b