Function at 0x14006aba0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
push rdi
sub rsp, 0x38
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r12
movsxd r12, dword [rcx + 0x3c]
add r12, rcx
mov qword [rsp + 0x28], r14
mov r14, rcx
mov edx, dword [r12 + 0x50]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, dword [r12 + 0x54]
mov rdi, rax
mov rax, qword [0x140254a98]
test rax, rax
jne 0x14006ac19
lea rcx, [0x140070808]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140070800]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140254a98], rax
mov r8, rbx
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x30], r13
call rax
movzx r11d, word [r12 + 0x14]
xor r15d, r15d
cmp word [r12 + 6], r15w
jbe 0x14006acf9
lea rbx, [r12 + r11 + 0x28]
nop
nop
mov esi, dword [rbx - 4]
mov rax, qword [0x140254aa0]
movsxd r12, dword [rbx - 8]
mov r13d, dword [rbx]
add rsi, rdi
test rax, rax
jne 0x14006ac8d
lea rcx, [0x140073e18]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140070818]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140254aa0], rax
mov rdx, r12
mov rcx, rsi
call rax
mov ebp, dword [rbx + 4]
mov rax, qword [0x140254a98]
add rbp, r14
test rax, rax
jne 0x14006accb
lea rcx, [0x140070808]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140070800]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140254a98], rax
cmp r12d, r13d
mov rdx, rbp
mov rcx, rsi
cmovl r13d, r12d
movsxd r8, r13d
call rax
mov r12, qword [rsp + 0x50]
add r15d, 1
movzx eax, word [r12 + 6]
add rbx, 0x28
cmp r15d, eax
jl 0x14006ac50
mov r11d, dword [r12 + 0xb0]
movsxd rbx, dword [r12 + 0xb4]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
add r11, rdi
mov r10, rdi
sub r10, qword [r12 + 0x30]
test rbx, rbx
mov r9, r11
jle 0x14006ad73
nop
nop
nop
mov eax, dword [r9 + 4]
lea rdx, [r9 + 8]
sub rax, 8
shr rax, 1
test eax, eax
jle 0x14006ad68
mov r8d, eax
mov ax, word [rdx]
test ax, 0xf000
je 0x14006ad5e
mov ecx, dword [r9]
and eax, 0xfff
add rax, rdi
add qword [rcx + rax], r10
add rdx, 2
sub r8, 1
jne 0x14006ad46
mov r9, rdx
sub rdx, r11
cmp rdx, rbx
jl 0x14006ad30
mov esi, dword [r12 + 0x90]
add rsi, rdi
mov eax, dword [rsi + 0xc]
test eax, eax
je 0x14006adeb
movabs r13, 0x8000000000000000
nop
mov ecx, eax
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [rsi + 4], 0
mov rbp, rax
jne 0x14006adac
mov ebx, dword [rsi + 0x10]
add rbx, rdi
jmp 0x14006adb1
mov ebx, dword [rsi]
add rbx, rdi
cmp qword [rbx], 0
je 0x14006ade0
mov rax, qword [rbx]
test r13, rax
je 0x14006adc4
movzx edx, ax
jmp 0x14006adc9
lea rdx, [rax + rdi + 2]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rbx, 8
mov qword [rbx - 8], rax
cmp qword [rbx], 0
jne 0x14006adb7
mov eax, dword [rsi + 0x20]
add rsi, 0x14
test eax, eax
jne 0x14006ad90
mov ebx, dword [r12 + 0x50]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbx
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r11d, dword [r12 + 0x28]
mov r13, qword [rsp + 0x30]
test r11d, r11d
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
je 0x14006ae43
mov rbx, r11
add rbx, rdi
je 0x14006ae43
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call rbx
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 2]
call rbx
mov rax, rdi
add rsp, 0x38
pop rdi
pop rbx
ret