Function at 0x14000b720
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link function at runtime on windows
Parse pe header

Disassembly:
push r14
sub rsp, 0x30
mov rax, qword [rcx]
mov r14, rcx
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x14000b752
lea rdx, str.Invalid_DOS_header_signature._n
lea rcx, [0x140236f10]
call fcn.1400029c0
xor al, al
add rsp, 0x30
pop r14
ret
mov qword [rsp + 0x48], rbp
movsxd rbp, dword [rax + 0x3c]
add rbp, rax
cmp dword [rbp], 0x4550
je 0x14000b788
lea rdx, str.Invalid_NT_header_signature._n
lea rcx, [0x140236f10]
call fcn.1400029c0
mov rbp, qword [rsp + 0x48]
xor al, al
add rsp, 0x30
pop r14
ret
mov edx, dword [rbp + 0x50]
mov r9d, 0x40
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], r15
mov r15d, 0x3000
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x14000b7ec
mov edx, dword [rbp + 0x50]
mov r9d, 0x40
mov r8d, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x14000b7ec
lea rdx, str.Failed_to_allocate_memory_for_the_PE_image._n
lea rcx, [0x140236f10]
call fcn.1400029c0
xor al, al
jmp 0x14000b982
mov r8d, dword [rbp + 0x54]
mov rcx, rsi
mov rdx, qword [r14]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x28], r12
call fcn.140071670
movzx ebx, word [rbp + 0x14]
xor r12d, r12d
add rbx, 0x2c
mov edi, r12d
cmp r12w, word [rbp + 6]
jae 0x14000b852
add rbx, rbp
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, dword [rbx - 8]
add rdx, qword [r14]
add rcx, rsi
mov r8d, dword [rbx - 4]
call fcn.140071670
movzx eax, word [rbp + 6]
lea rbx, [rbx + 0x28]
inc edi
cmp edi, eax
jl 0x14000b830
mov rcx, qword [rbp + 0x30]
cmp rsi, rcx
je 0x14000b8e9
mov rdx, qword [rbp + 0xb0]
mov rax, rdx
shr rax, 0x20
test eax, eax
je 0x14000b8e9
mov r9d, edx
mov r11, rsi
add r9, rsi
sub r11, rcx
cmp dword [r9], r12d
je 0x14000b8e9
mov ebx, 0xf000
nop word [rax + rax]
mov eax, dword [r9 + 4]
mov rdx, r12
sub rax, 8
shr rax, 1
movsxd r10, eax
test eax, eax
jle 0x14000b8dd
nop word [rax + rax]
movzx r8d, word [r9 + rdx*2 + 8]
movzx eax, r8w
and ax, bx
cmp ax, r15w
jne 0x14000b8d5
mov ecx, dword [r9]
and r8d, 0xfff
lea rax, [rsi + r8]
add dword [rcx + rax], r11d
inc rdx
cmp rdx, r10
jl 0x14000b8b0
mov eax, dword [r9 + 4]
add r9, rax
cmp dword [r9], r12d
jne 0x14000b890
mov rcx, qword [rbp + 0x90]
mov r12, qword [rsp + 0x28]
mov rax, rcx
shr rax, 0x20
test eax, eax
je 0x14000b96e
mov r14d, ecx
add r14, 0xc
add r14, rsi
mov eax, dword [r14]
test eax, eax
je 0x14000b96e
mov ebx, eax
add rbx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000b998
mov ebx, dword [r14 + 4]
add rbx, rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000b962
mov rdx, rcx
mov rcx, rdi
jns 0x14000b943
movzx edx, dx
jmp 0x14000b94a
add rdx, 2
add rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
add rbx, 8
mov rcx, qword [rbx]
mov rdx, rcx
test rcx, rcx
jne 0x14000b939
mov eax, dword [r14 + 0x14]
add r14, 0x14
test eax, eax
jne 0x14000b911
mov eax, dword [rbp + 0x28]
add rax, rsi
call rax
mov al, 1
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop r14
ret
lea rdx, str.Failed_to_load_module:
lea rcx, [0x140236f10]
call fcn.1400029c0
mov rcx, rax
mov rdx, rbx
call fcn.1400029c0
mov rcx, rax
mov dl, 0xa
call fcn.1400026e0
xor al, al
jmp 0x14000b978