Function at 0x140006320
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [0x140025010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9d, edx
mov r12, r8
mov rbp, rcx
cmp edx, 0x40
jb 0x14000662f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000662f
movsxd r14, dword [rcx + 0x3c]
mov eax, r9d
lea r8, [r14 + 0x108]
cmp r9, r8
jb 0x14000662f
cmp dword [r14 + rcx], 0x4550
jne 0x14000662f
movzx eax, word [r14 + rcx + 0x16]
mov ecx, 0x2000
test cx, ax
je 0x14000662f
test al, 2
je 0x14000662f
mov eax, 0xf0
cmp word [r14 + rbp + 0x14], ax
jne 0x14000662f
movzx r10d, word [r14 + rbp + 6]
xor r13d, r13d
test r10, r10
je 0x1400063ea
lea rcx, [rbp + 0x118]
mov edx, r13d
add rcx, r14
nop dword [rax + rax]
mov eax, dword [rcx + 4]
add eax, dword [rcx]
cmp eax, r9d
ja 0x14000662f
inc rdx
add rcx, 0x28
cmp rdx, r10
jl 0x1400063d0
mov ebx, dword [r14 + rbp + 0x38]
mov r9d, dword [r14 + rbp + 0x54]
dec r9d
add r9d, ebx
mov eax, r9d
cdq
idiv ebx
sub r9d, edx
test r10, r10
je 0x140006453
lea r11, [rbp + 0x118]
add r11, r14
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r11 - 8]
lea r8d, [rbx - 1]
cmp dword [r11], ecx
cmovg ecx, dword [r11]
add ecx, dword [r11 - 4]
lea r11, [r11 + 0x28]
add r8d, ecx
mov eax, r8d
cdq
idiv ebx
sub r8d, edx
cmp r9d, r8d
cmovge r8d, r9d
mov r9d, r8d
sub r10, 1
jne 0x140006420
test r9d, r9d
je 0x14000662f
movsxd r15, r9d
mov r8d, 0x3000
mov rdx, r15
mov r9d, 0x40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14000662f
movzx ecx, word [r14 + rbp + 6]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x30], rdi
lea edx, [rcx + rcx*4]
mov ecx, dword [r14 + rbp + 0x54]
lea edx, [rcx + rdx*8]
mov rcx, rax
movsxd r8, edx
mov rdx, rbp
call fcn.14000ab00
mov esi, r13d
cmp r13w, word [r14 + rbp + 6]
jae 0x1400064ef
lea rdi, [rbp + 0x118]
add rdi, r14
mov eax, dword [rdi - 4]
test eax, eax
je 0x1400064df
mov ecx, dword [rdi]
test ecx, ecx
je 0x1400064df
mov edx, dword [rdi + 4]
mov r8d, ecx
add rdx, rbp
lea rcx, [rbx + rax]
call fcn.14000ab00
movzx eax, word [r14 + rbp + 6]
inc esi
add rdi, 0x28
cmp esi, eax
jl 0x1400064c0
movsxd rdi, dword [rbx + 0x3c]
add rdi, rbx
mov eax, dword [rdi + 0xb0]
test eax, eax
je 0x14000659a
cmp dword [rdi + 0xb4], r13d
jbe 0x14000659a
mov ecx, dword [rbx + rax]
lea r9, [rbx + rax]
mov edx, dword [r9 + 4]
add ecx, edx
je 0x14000659a
mov esi, 0xa000
mov r11d, 0xf000
nop dword [rax + rax]
mov ecx, edx
mov rax, r13
sub rcx, 8
shr rcx, 1
movsxd r10, ecx
test ecx, ecx
jle 0x14000658a
nop dword [rax]
nop word [rax + rax]
movzx r8d, word [r9 + rax*2 + 8]
movzx ecx, r8w
and cx, r11w
cmp cx, si
jne 0x14000657e
mov edx, dword [r9]
and r8d, 0xfff
lea rcx, [rbx + r8]
add rdx, rcx
mov rcx, rbx
sub rcx, qword [rdi + 0x30]
add qword [rdx], rcx
inc rax
cmp rax, r10
jl 0x140006550
mov edx, dword [r9 + 4]
mov eax, edx
add r9, rax
mov ecx, dword [r9]
mov edx, dword [r9 + 4]
add ecx, edx
jne 0x140006530
mov rdx, rbx
mov rcx, rdi
call fcn.140006140
mov rsi, qword [rsp + 0x78]
mov rcx, rbx
test eax, eax
jne 0x1400065e2
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140007140
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rdi + 0x30], rbx
mov r8, r12
mov edi, dword [rdi + 0x28]
mov edx, 1
add rdi, rbx
mov rcx, rbx
call rdi
test eax, eax
jne 0x140006628
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rdi
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
jmp 0x1400065b9
mov eax, 1
jmp 0x1400065c1
xor eax, eax
jmp 0x1400065c6