Function at 0x140002970
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd r13, dword [rcx + 0x3c]
xor r12d, r12d
add r13, rcx
mov r15, rcx
mov r14d, r12d
lea rcx, str.ntdll.dll
mov rbp, qword [r13 + 0x30]
lea rax, [r13 + 0xb0]
cmp dword [rax], r12d
cmovne r14, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtUnmapViewOfSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [r13 + 0x30]
lea rcx, [r12 - 1]
call rax
mov edx, dword [r13 + 0x50]
lea r9d, [r12 + 0x40]
mov r8d, 0x3000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x140002a81
lea rcx, [0x14003c940]
test r14, r14
jne 0x140002a22
lea rdx, str.____No_Relocation_Table_and_Cannot_load_to_the_preferable_address
call fcn.140005390
mov rcx, rax
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140005640
lea rdx, str.___Cannot_load_to_the_preferable_address
call fcn.140005390
mov rcx, rax
call fcn.140005640
mov edx, dword [r13 + 0x50]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x140002a81
lea rdx, str.____Cannot_allocate_the_memory
lea rcx, [0x14003c940]
call fcn.140005390
mov rcx, rax
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140005640
mov r8d, dword [r13 + 0x54]
mov rdx, r15
mov qword [rsp + 0x50], rbx
mov rcx, rdi
mov qword [rsp + 0x58], rsi
mov qword [r13 + 0x30], rdi
call fcn.14000b110
lea rdx, str.___All_headers_are_copied
lea rcx, [0x14003c940]
call fcn.140005390
mov rcx, rax
call fcn.140005640
mov esi, r12d
cmp r12w, word [r13 + 6]
jae 0x140002af3
lea rbx, [r13 + 0x11c]
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, dword [rbx - 8]
add rdx, r15
mov r8d, dword [rbx - 4]
add rcx, rdi
call fcn.14000b110
movzx eax, word [r13 + 6]
lea rbx, [rbx + 0x28]
inc esi
cmp esi, eax
jl 0x140002ad0
lea rdx, str.___All_sections_are_copied
lea rcx, [0x14003c940]
call fcn.140005390
mov rcx, rax
call fcn.140005640
mov rcx, rdi
call fcn.140002740
cmp rdi, rbp
je 0x140002bcc
test r14, r14
je 0x140002bb1
mov esi, dword [r14 + 4]
mov r11, r12
mov r14d, dword [r14]
test rsi, rsi
je 0x140002ba8
mov r15d, 0x1000
nop dword [rax]
lea r10, [r11 + r14]
add r10, rdi
mov eax, dword [r10]
test eax, eax
je 0x140002ba3
mov ecx, dword [r10 + 4]
test ecx, ecx
je 0x140002ba3
lea r9, [rcx - 8]
mov ebx, eax
shr r9, 1
lea r8, [r10 + 8]
mov edx, r12d
je 0x140002b97
nop dword [rax + rax]
movzx eax, word [r8]
cmp ax, r15w
jb 0x140002b8d
and eax, 0xfff
mov ecx, edi
add rax, rbx
sub ecx, ebp
add dword [rax + rdi], ecx
add r8, 2
inc edx
movsxd rax, edx
cmp rax, r9
jb 0x140002b70
mov eax, dword [r10 + 4]
add r11, rax
cmp r11, rsi
jb 0x140002b40
test r11, r11
jne 0x140002bcc
lea rdx, str.____There_is_a_problem_in_relocation_directory
jmp 0x140002bb8
lea rdx, str.____No_Reloc_Table_Found
lea rcx, [0x14003c940]
call fcn.140005390
mov rcx, rax
call fcn.140005640
mov ebx, dword [r13 + 0x28]
lea rdx, str.___Binary_is_running
lea rcx, [0x14003c940]
add rbx, rdi
call fcn.140005390
mov rcx, rax
call fcn.140005640
mov rax, rbx
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp rax