Function at 0x1800492e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
mov rdi, rcx
test rcx, rcx
je 0x180049555
mov eax, 0x5a4d
cmp ax, word [rcx]
jne 0x180049555
mov qword [rsp + 0x30], r13
movsxd r13, dword [rcx + 0x3c]
add r13, rcx
cmp dword [r13], 0x4550
je 0x180049323
xor eax, eax
mov r13, qword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x28], r14
mov r14d, dword [r13 + 0x50]
mov r9d, 0x40
mov r8d, 0x1000
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x18004952a
mov r8, r14
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
call fcn.180054ba0
movzx esi, word [r13 + 0x14]
movzx ebx, word [r13 + 6]
mov rdx, rdi
mov r8d, dword [rsi + r13 + 0x24]
mov rcx, r12
call fcn.18005a1e0
mov r11, rbx
test ebx, ebx
jle 0x1800493be
lea rbx, [rsi + r13 + 0x2c]
mov rsi, r11
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, dword [rbx - 8]
mov r8d, dword [rbx - 4]
add rdx, rdi
add rcx, r12
call fcn.18005a1e0
add rbx, 0x28
sub rsi, 1
jne 0x1800493a0
cmp dword [r13 + 0x94], 0
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x20], r15
jbe 0x180049478
mov ebp, dword [r13 + 0x90]
add rbp, r12
mov eax, dword [rbp + 0xc]
test eax, eax
je 0x180049478
movabs r15, 0x8000000000000000
nop word [rax + rax]
mov edi, dword [rbp + 0x10]
mov ebx, dword [rbp]
mov ecx, eax
add rcx, r12
add rdi, r12
add rbx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18004953f
mov rcx, qword [rbx]
test rcx, rcx
je 0x18004946d
nop dword [rax + rax]
test r15, rcx
je 0x180049443
movzx edx, cx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x180049451
lea rdx, [rcx + r12 + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18004953f
add rbx, 8
mov qword [rdi], rax
add rdi, 8
mov rcx, qword [rbx]
test rcx, rcx
jne 0x180049430
mov eax, dword [rbp + 0x20]
add rbp, 0x14
test eax, eax
jne 0x180049400
cmp dword [r13 + 0xb4], 0
jbe 0x180049500
mov ecx, dword [r13 + 0xb0]
mov r10, r12
sub r10, qword [r13 + 0x30]
add rcx, r12
mov eax, dword [rcx]
test eax, eax
je 0x180049500
mov ebx, 0xf000
mov edi, 0xa000
nop word [rax + rax]
mov r9d, eax
mov eax, dword [rcx + 4]
lea r11, [rcx + 8]
sub rax, 8
add r9, r12
xor ecx, ecx
shr rax, 1
movsxd r8, eax
test eax, eax
jle 0x1800494f4
nop dword [rax]
mov ax, word [r11 + rcx*2]
mov edx, eax
and ax, bx
and edx, 0xfff
cmp ax, di
jne 0x1800494ec
movsxd rax, edx
add qword [rax + r9], r10
inc rcx
cmp rcx, r8
jl 0x1800494d0
mov eax, dword [r11 + r8*2]
lea rcx, [r11 + r8*2]
test eax, eax
jne 0x1800494b0
mov eax, dword [r13 + 0x28]
xor r8d, r8d
mov rcx, r12
lea edx, [r8 + 1]
add rax, r12
call rax
mov rax, r12
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x38]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
mov r8d, 0x4000
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x180049516
xor eax, eax
add rsp, 0x40
pop rdi
ret