Function at 0x401d20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00407684]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x401e3a
mov rax, qword [0x00407688]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x401d6e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x401e20
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x401d52
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x401e72
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00407688]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00407688]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401e55
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401e19
sub eax, 0x40
and eax, 0xffffffbf
je 0x401e19
mov r9, rbp
add r9, qword [0x00407688]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401e41
add dword [0x00407684], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x401d7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00407688]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x4025f0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004079a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00407980]
test rbx, rbx
je 0x402644
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40263b
test rsi, rsi
je 0x40263b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402620
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004079a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x402880
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402890
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x4028a0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4028e1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x4028d8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x4028e3
add rax, 0x28
cmp rax, r9
jne 0x4028c4
xor eax, eax
repz ret