Function at 0x1400e5730
Capabilities:
Access pe header
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1401c0040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r14, rcx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rdi, rax
test rax, rax
jne 0x1400e5768
xor ebx, ebx
mov eax, ebx
jmp 0x1400e583b
xorps xmm0, xmm0
mov qword [rsp + 0xc8], rbp
lea rcx, [rsp + 0x28]
mov qword [rsp + 0xd0], rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx esi, word [rdi + 0x14]
xor ebx, ebx
movzx r8d, word [rdi + 6]
add rsi, rdi
mov ebp, dword [rsp + 0x50]
movzx edx, bx
cmp bx, r8w
jae 0x1400e57e4
mov r10, qword [rdi + 0x30]
lea r11d, [rbp - 1]
nop dword [rax + rax]
movzx eax, dx
lea rcx, [rax + rax*4]
mov eax, dword [rsi + rcx*8 + 0x24]
mov ecx, ebx
add rax, r10
test r11, rax
sete cl
test r11, rax
jne 0x1400e57f0
inc dx
cmp dx, r8w
jb 0x1400e57c0
lea ecx, [rbp - 1]
test qword [rdi + 0x30], rcx
mov ecx, ebx
sete cl
test ecx, ecx
je 0x1400e59cc
mov edx, dword [rdi + 0x50]
mov ebp, 0x40
mov r9d, ebp
mov qword [rsp + 0x90], r15
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x1400e5857
mov eax, ebx
mov r15, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14014fd50
add rsp, 0xa0
pop r14
pop rdi
pop rbx
ret
mov rdx, r15
mov rcx, rdi
call fcn.1400e59e0
lea rax, [0x1400e5a80]
mov rcx, r15
sub rax, r14
add rax, r15
call rax
mov edi, eax
test eax, eax
je 0x1400e59b0
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rsi, rax
test rax, rax
jne 0x1400e5896
mov edi, ebx
jmp 0x1400e59b0
movzx edi, bx
movzx eax, word [rax + 0x14]
mov qword [rsp + 0xd8], r12
mov r12d, 1
mov qword [rsp + 0x98], r13
cmp bx, word [rsi + 6]
jae 0x1400e594a
lea r13, [rax + rsi]
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movzx eax, di
mov r8d, 0x30
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0x58]
movups xmmword [rsp + 0x58], xmm0
lea rcx, [rax + rax*4]
mov ebp, dword [r13 + rcx*8 + 0x24]
add rbp, r14
mov rcx, rbp
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400e59c8
cmp dword [rsp + 0x7c], 0x40
lea r9, [rsp + 0x20]
mov rdx, qword [rsp + 0x70]
mov r8d, r12d
mov eax, 0x40
mov rcx, rbp
cmovne r8d, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400e59c8
inc di
cmp di, word [rsi + 6]
jb 0x1400e58d0
lea ebp, [rax + 0x40]
xorps xmm0, xmm0
mov dword [rsp + 0x24], ebx
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, r14
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400e59c8
cmp dword [rsp + 0x4c], 0x40
lea r9, [rsp + 0x24]
mov rdx, qword [rsp + 0x40]
mov rcx, r14
cmovne r12d, ebp
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov edi, ebx
sete dil
mov r13, qword [rsp + 0x98]
mov r12, qword [rsp + 0xd8]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x1400e5823
mov edi, ebx
jmp 0x1400e59a0
mov eax, ecx
jmp 0x1400e582b