Function at 0x140001460
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
pause
pause
pause
nop
nop
nop
pause
pause
pause
nop
nop
nop
pause
pause
pause
nop
nop
nop
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x140001610
mov rsi, rcx
pause
pause
pause
nop
nop
nop
pause
pause
pause
nop
nop
nop
pause
pause
pause
nop
nop
nop
movsxd r14, dword [rcx + 0x3c]
pause
pause
pause
nop
nop
nop
cmp dword [rcx + r14], 0x4550
jne 0x140001623
pause
pause
pause
nop
nop
nop
mov edx, dword [rsi + r14 + 0x50]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
pause
pause
pause
nop
nop
nop
test rax, rax
je 0x140001745
mov rdi, rax
pause
pause
pause
nop
nop
nop
pause
pause
pause
nop
nop
nop
mov r8d, dword [rsi + r14 + 0x54]
mov rcx, rax
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
pause
pause
pause
nop
nop
nop
pause
pause
pause
nop
nop
nop
cmp word [rsi + r14 + 6], 0
je 0x1400015aa
lea rbx, [r14 + rsi]
add rbx, 0x11c
xor r15d, r15d
nop word cs:[rax + rax]
pause
pause
pause
nop
nop
nop
mov ecx, dword [rbx - 8]
pause
pause
pause
nop
nop
nop
mov edx, dword [rbx]
pause
pause
pause
add rcx, rdi
add rdx, rsi
nop
nop
nop
mov r8d, dword [rbx - 4]
call sub.VCRUNTIME140.dll_memcpy
pause
pause
pause
nop
nop
nop
inc r15
movzx eax, word [rsi + r14 + 6]
add rbx, 0x28
cmp r15, rax
jb 0x140001560
pause
pause
pause
nop
nop
nop
mov eax, dword [rsi + r14 + 0x90]
mov ecx, dword [rsi + r14 + 0x94]
pause
pause
pause
nop
nop
nop
test ecx, ecx
je 0x140001704
pause
pause
pause
nop
nop
nop
pause
pause
pause
nop
nop
nop
cmp dword [rdi + rax + 0xc], 0
je 0x140001704
lea r15, [rdi + rax]
add rax, rdi
add rax, 0xc
lea r12, [rdi + 2]
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140001662
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x1400043eb]
jmp 0x140001763
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x1400043d5]
jmp 0x140001763
pause
pause
pause
nop
nop
nop
pause
pause
pause
nop
nop
nop
lea rax, [r15 + 0x20]
cmp dword [r15 + 0x20], 0
lea r15, [r15 + 0x14]
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
je 0x140001704
pause
pause
pause
nop
nop
nop
mov ecx, dword [rax]
pause
pause
pause
add rcx, rdi
nop
nop
nop
call rdx
pause
pause
pause
nop
nop
nop
test rax, rax
je 0x1400017a4
pause
pause
pause
nop
nop
nop
mov r13d, dword [r15 + 0x10]
pause
pause
pause
nop
nop
nop
cmp qword [rdi + r13], 0
je 0x140001636
mov rbx, rax
add r13, rdi
pause
pause
pause
nop
nop
nop
mov rdx, qword [r13]
pause
pause
pause
add rdx, r12
nop
nop
nop
mov rcx, rbx
call rbp
mov qword [r13], rax
pause
pause
pause
nop
nop
nop
cmp qword [r13], 0
je 0x140001755
pause
pause
pause
nop
nop
nop
pause
pause
pause
nop
nop
nop
cmp qword [r13 + 8], 0
lea r13, [r13 + 8]
jne 0x1400016b0
jmp 0x140001636
pause
pause
pause
nop
nop
nop
pause
pause
pause
nop
nop
nop
mov eax, dword [rsi + r14 + 0x28]
pause
pause
pause
mov r9, rdi
add r9, rax
nop
nop
nop
mov rcx, rdi
mov edx, 1
xor r8d, r8d
call r9
pause
pause
pause
nop
nop
nop
mov al, 1
jmp 0x140001793
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x1400044c1]
jmp 0x140001763
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140004445]
call fcn.1400011f0
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140004402]
jmp 0x140001763