Function at 0x140007834
Capabilities:
Access pe header
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor esi, esi
mov r12, r8
mov r14d, esi
mov r15d, esi
mov rbx, rdx
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
lea r13d, [rsi + 0x58]
mov r8d, 0x2a6cf6e7
test rax, rax
lea ecx, [rsi + 1]
mov edx, r13d
mov rdi, rax
setne byte [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r8d, r13d
xor edx, edx
mov rcx, rax
mov qword [rbp - 0x40], rax
mov rsi, rax
call fcn.1400021c0
lea r13, [rsi + 0x30]
mov rdx, rbx
mov rcx, r13
call fcn.140009f28
lea rdx, [rsi + 0x20]
mov rcx, r13
call fcn.14000a014
mov eax, dword [rbp + 0x68]
lea rdx, [rsi + 0x20]
mov rcx, qword [rbp + 0x70]
mov dword [rsi + 0x4c], eax
xor eax, eax
mov r8d, eax
test rdi, rdi
sete r8b
add rcx, 0x20
mov dword [rsi + 0x48], r8d
call fcn.140008078
mov rbx, rax
test rax, rax
je 0x140007952
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov edx, 0x2a6cf6e7
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rbp + 0x78]
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rax + 0x40], xmm0
movsd xmm1, qword [rbx + 0x50]
movsd qword [rax + 0x50], xmm1
xor eax, eax
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ebx, ebx
lea r13, [rsi + 0x18]
test r12, r12
jne 0x140007a14
mov rcx, qword [rbp + 0x48]
mov rdx, r13
call fcn.140007f00
mov r14d, eax
test eax, eax
jns 0x140007a18
mov edi, dword [rbp + 0x68]
mov eax, edi
and eax, 0x8000
test r14d, r14d
js 0x140007a37
test eax, eax
jne 0x1400079a0
mov rcx, qword [r13]
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x38]
call fcn.140007ddc
test dil, 0x10
je 0x140007b62
mov r12, qword [rbp + 0x40]
xorps xmm0, xmm0
mov rcx, r12
mov qword [rbp - 0x28], rbx
mov word [rbp - 0xa], bx
movups xmmword [rbp - 0x38], xmm0
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
lea r8, [rbp - 0x38]
mov word [rbp - 0xc], 0x101
mov dword [rbp - 0x18], eax
lea rdx, [rbp - 0x28]
mov eax, dword [r15 + 0x50]
mov rcx, r12
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x14], 4
mov dword [rbp - 0x10], 0x8000
call fcn.140009910
mov r14d, eax
test eax, eax
js 0x140007a3b
mov rcx, qword [rbp - 0x38]
lea rbx, [rsi + 0x10]
mov qword [rbx], rcx
mov rcx, qword [rbp - 0x30]
mov qword [rsi + 0x40], rcx
jmp 0x140007bef
mov qword [r13], r12
mov rcx, qword [r13]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov r15, rax
test rax, rax
jne 0x140007978
mov r14d, 0xc000007b
mov edi, dword [rbp + 0x68]
mov r12, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x70]
lea rcx, [rdx + 0x20]
mov rax, qword [rcx]
cmp qword [rax + 8], rcx
jne 0x140007dd2
mov qword [rsi], rax
lea rbx, [rsi + 0x10]
mov qword [rsi + 8], rcx
mov qword [rax + 8], rsi
mov qword [rcx], rsi
test r14d, r14d
js 0x140007cd5
mov rcx, qword [rbx]
mov eax, 0x10b
cmp word [r15 + 0x18], ax
mov r8, r12
mov dword [rsp + 0x28], edi
sete r9b
mov qword [rsp + 0x20], rdx
xor edx, edx
call fcn.140008ae8
xor ecx, ecx
mov r14d, eax
test eax, eax
js 0x140007cd5
test dil, 0x10
jne 0x140007ccd
mov eax, dword [r15 + 0x54]
lea r9d, [rcx + 2]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x70]
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x70], rax
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
mov r14d, eax
lea r12, [r15 + 0x108]
mov eax, 0x10b
cmp word [r15 + 0x18], ax
jne 0x140007ae5
lea r12, [r15 + 0xf8]
movzx eax, word [r15 + 6]
lea rcx, [rax + rax*4]
lea rax, [r12 + rcx*8]
cmp r12, rax
jae 0x140007cc8
mov sil, byte [rbp - 0x50]
mov r13d, edi
and r13d, 0x1000
lea rdi, [r12 + 0xc]
xor eax, eax
test r13d, r13d
jne 0x140007b1c
mov dl, 1
test sil, sil
jne 0x140007b1e
mov dl, al
mov ecx, dword [rdi + 0x18]
call fcn.140007508
mov ecx, dword [rdi]
lea r8, [rbp + 0x70]
add rcx, qword [rbx]
lea rdx, [rbp - 0x48]
mov qword [rbp - 0x48], rcx
mov ecx, dword [rdi - 4]
mov qword [rbp + 0x70], rcx
or rcx, 0xffffffffffffffff
cmp eax, 1
je 0x140007c93
and qword [rsp + 0x20], 0
mov r9d, eax
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
or r14d, eax
jmp 0x140007c9f
mov eax, 0x20b
cmp word [r15 + 0x18], ax
jne 0x140007b74
mov rax, qword [r15 + 0x30]
jmp 0x140007b78
mov eax, dword [r15 + 0x34]
lea rbx, [rsi + 0x10]
mov dword [rsp + 0x28], 0x40
mov qword [rbx], rax
lea rdi, [rsi + 0x40]
mov eax, dword [r15 + 0x50]
mov r9, rdi
xor r8d, r8d
mov qword [rdi], rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x1000
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
xor r12d, r12d
mov r14d, eax
test eax, eax
jns 0x140007bef
mov qword [rbx], r12
mov r9, rdi
mov eax, dword [r15 + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], 0x40
mov rdx, rbx
or rcx, 0xffffffffffffffff
mov qword [rdi], rax
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov r14d, eax
test eax, eax
js 0x140007a34
mov r8d, dword [r15 + 0x54]
mov rdx, qword [r13]
mov rcx, qword [rbx]
call fcn.1400022c0
mov eax, 0x10b
lea r12, [r15 + 0x108]
cmp word [r15 + 0x18], ax
jne 0x140007c19
lea r12, [r15 + 0xf8]
movzx eax, word [r15 + 6]
lea rcx, [rax + rax*4]
lea rax, [r12 + rcx*8]
cmp r12, rax
jae 0x140007c6e
lea rdi, [r12 + 0x10]
test dword [rdi + 0x14], 0xe0000000
je 0x140007c54
mov eax, dword [rdi]
test eax, eax
je 0x140007c54
mov edx, dword [rdi + 4]
mov r8d, eax
mov ecx, dword [rdi - 4]
add rdx, qword [r13]
add rcx, qword [rbx]
call fcn.1400022c0
movzx eax, word [r15 + 6]
add rdi, 0x28
lea rcx, [rax + rax*4]
lea rdx, [r12 + rcx*8]
lea rax, [rdi - 0x10]
cmp rax, rdx
jb 0x140007c30
test r14d, r14d
js 0x140007a34
mov rcx, qword [rbx]
mov r9d, 0xc000007b
xor edx, edx
lea r8d, [r9 - 0x63]
call fcn.140001398
mov r14d, eax
jmp 0x140007a34
mov r9d, 0x4000
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
movzx eax, word [r15 + 6]
add rdi, 0x28
lea rcx, [rax + rax*4]
lea rdx, [r12 + rcx*8]
lea rax, [rdi - 0xc]
cmp rax, rdx
jb 0x140007b0e
mov rsi, qword [rbp - 0x40]
mov edi, dword [rbp + 0x68]
lea r13, [rsi + 0x18]
test r14d, r14d
js 0x140007cd5
mov rcx, qword [rbx]
call fcn.140007564
mov rcx, qword [r13]
xor r15d, r15d
test rcx, rcx
je 0x140007cf0
mov edx, 0x2a6cf6e7
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [r13], r15
test r14d, r14d
js 0x140007d37
mov rax, qword [rbp + 0x78]
test rax, rax
je 0x140007dca
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rsi + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rsi + 0x40]
movups xmmword [rax + 0x40], xmm0
movsd xmm1, qword [rsi + 0x50]
movsd qword [rax + 0x50], xmm1
jmp 0x140007dca
mov rax, qword [rsi]
cmp qword [rax + 8], rsi
jne 0x140007dd2
mov rcx, qword [rsi + 8]
cmp qword [rcx], rsi
jne 0x140007dd2
mov qword [rcx], rax
mov qword [rax + 8], rcx
cmp qword [rbx], r15
je 0x140007db2
test dil, 0x10
je 0x140007d97
mov rcx, qword [rbp + 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 0x38], xmm0
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov rcx, qword [rbp + 0x40]
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x18], eax
mov word [rbp - 0xc], r15w
call fcn.140009910
jmp 0x140007db2
mov r9d, 0x8000
mov qword [rbp + 0x70], r15
lea r8, [rbp + 0x70]
mov rdx, rbx
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
lea rcx, [rsi + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov edx, 0x2a6cf6e7
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, r14d
jmp 0x140007937
mov ecx, 3
int 0x29
int3