Function at 0x1400013c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x1400014e3
mov rsi, rcx
pause
pause
pause
nop
nop
nop
movsxd r14, dword [rcx + 0x3c]
cmp dword [rcx + r14], 0x4550
jne 0x1400014f6
pause
pause
pause
nop
nop
nop
mov edx, dword [rsi + r14 + 0x50]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14000159f
mov rdi, rax
pause
pause
pause
nop
nop
nop
mov r8d, dword [rsi + r14 + 0x54]
mov rcx, rax
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
pause
pause
pause
nop
nop
nop
cmp word [rsi + r14 + 6], 0
je 0x140001496
lea rbx, [r14 + rsi]
add rbx, 0x11c
xor r15d, r15d
nop word cs:[rax + rax]
mov ecx, dword [rbx - 8]
mov r8d, dword [rbx - 4]
add rcx, rdi
mov edx, dword [rbx]
add rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
inc r15
movzx eax, word [rsi + r14 + 6]
add rbx, 0x28
cmp r15, rax
jb 0x140001470
pause
pause
pause
nop
nop
nop
cmp dword [rsi + r14 + 0x94], 0
je 0x140001570
mov r15d, dword [rsi + r14 + 0x90]
mov eax, dword [rdi + r15 + 0xc]
test eax, eax
je 0x140001570
add r15, rdi
lea r12, [rdi + 2]
lea rcx, [rdi + 8]
mov qword [rsp + 0x20], rcx
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14000151c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x1400033eb]
jmp 0x1400015bd
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x1400033d5]
jmp 0x1400015bd
mov eax, dword [r15 + 0x20]
add r15, 0x14
test eax, eax
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
je 0x140001570
mov ecx, eax
add rcx, rdi
call rdx
test rax, rax
je 0x1400015fe
mov r13d, dword [r15 + 0x10]
mov rdx, qword [rdi + r13]
test rdx, rdx
je 0x140001509
mov rbx, rax
add r13, qword [rsp + 0x20]
nop word cs:[rax + rax]
add rdx, r12
mov rcx, rbx
call rbp
mov qword [r13 - 8], rax
test rax, rax
je 0x1400015af
mov rdx, qword [r13]
add r13, 8
test rdx, rdx
jne 0x140001550
jmp 0x140001509
pause
pause
pause
nop
nop
nop
mov eax, dword [rsi + r14 + 0x28]
mov r9, rdi
add r9, rax
mov rcx, rdi
mov edx, 1
xor r8d, r8d
call r9
pause
pause
pause
nop
nop
nop
mov al, 1
jmp 0x1400015ed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x1400034a5]
jmp 0x1400015bd
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140003445]
call fcn.140001150
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140003402]
jmp 0x1400015bd