Function at 0x180026e60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rdi
push r15
sub rsp, 0x30
mov r15, r9
mov rbp, r8
mov rdi, rcx
test rcx, rcx
je 0x1800270e8
mov eax, 0x5a4d
cmp ax, word [rcx]
jne 0x1800270e8
mov qword [rsp + 0x20], r14
movsxd r14, dword [rcx + 0x3c]
add r14, rcx
cmp dword [r14], 0x4550
je 0x180026eb2
xor eax, eax
mov r14, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop rdi
pop rbp
ret
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x28], r13
mov r13d, dword [r14 + 0x50]
mov r9d, 0x40
mov r8d, 0x1000
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x180027013
mov r8, r13
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
call fcn.180035fe0
movzx esi, word [r14 + 0x14]
movzx ebx, word [r14 + 6]
mov rdx, rdi
mov r8d, dword [rsi + r14 + 0x24]
mov rcx, r12
call fcn.18003b330
mov r11, rbx
test ebx, ebx
jle 0x180026f4e
lea rbx, [rsi + r14 + 0x2c]
mov rsi, r11
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, dword [rbx - 8]
mov r8d, dword [rbx - 4]
add rdx, rdi
add rcx, r12
call fcn.18003b330
add rbx, 0x28
sub rsi, 1
jne 0x180026f30
cmp dword [r14 + 0x94], 0
jbe 0x180027030
mov ebp, dword [r14 + 0x90]
add rbp, r12
mov eax, dword [rbp + 0xc]
test eax, eax
je 0x18002702b
mov edi, dword [rbp + 0x10]
mov ebx, dword [rbp]
mov ecx, eax
add rcx, r12
add rdi, r12
add rbx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180026ff5
mov rcx, qword [rbx]
test rcx, rcx
je 0x180026fe3
nop dword [rax + rax]
movabs rax, 0x8000000000000000
test rax, rcx
je 0x180026fbd
movzx edx, cx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x180026fcb
lea rdx, [rcx + r12 + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180026ff5
add rbx, 8
mov qword [rdi], rax
add rdi, 8
mov rcx, qword [rbx]
test rcx, rcx
jne 0x180026fa0
mov eax, dword [rbp + 0x20]
add rbp, 0x14
test eax, eax
jne 0x180026f71
mov rbp, qword [rsp + 0x60]
jmp 0x180027030
mov r8d, 0x4000
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x68]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop rdi
pop rbp
ret
mov rbp, qword [rsp + 0x60]
cmp dword [r14 + 0xb4], 0
jbe 0x1800270b0
mov ecx, dword [r14 + 0xb0]
mov r10, r12
sub r10, qword [r14 + 0x30]
add rcx, r12
mov eax, dword [rcx]
test eax, eax
je 0x1800270b0
mov ebx, 0xf000
mov edi, 0xa000
nop dword [rax + rax]
mov r9d, eax
mov eax, dword [rcx + 4]
lea r11, [rcx + 8]
sub rax, 8
add r9, r12
xor ecx, ecx
shr rax, 1
movsxd r8, eax
test eax, eax
jle 0x1800270a4
nop dword [rax]
mov ax, word [r11 + rcx*2]
mov edx, eax
and ax, bx
and edx, 0xfff
cmp ax, di
jne 0x18002709c
movsxd rax, edx
add qword [rax + r9], r10
inc rcx
cmp rcx, r8
jl 0x180027080
mov eax, dword [r11 + r8*2]
lea rcx, [r11 + r8*2]
test eax, eax
jne 0x180027060
mov eax, dword [r14 + 0x28]
mov r8, rbp
mov edx, 1
add rax, r12
mov rcx, r12
call rax
test r15, r15
je 0x1800270e0
mov rdx, r15
mov rcx, r12
call fcn.180026d50
test rax, rax
je 0x1800270e0
mov rcx, qword [rsp + 0x70]
call rax
mov rax, r12
jmp 0x180027009
xor eax, eax
add rsp, 0x30
pop r15
pop rdi
pop rbp
ret