Function at 0x1400c9530
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x560
mov rbx, rcx
mov rsi, rdx
lea rcx, [rax - 0x4e0]
xor r15d, r15d
xor edx, edx
mov r8d, 0x4c8
mov r12, r9
mov qword [rax - 0x4e8], r15
call fcn.1400dfee0
mov r14d, dword [rsp + 0x5b0]
xor eax, eax
cmp qword [rsp + 0x5d0], r15
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x5d8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x5c8]
lea rdi, [rsp + 0x78]
cmovne rdi, qword [rsp + 0x5d0]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x5c0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x5b8]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x5a8]
mov rcx, rbx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x78], r15
call fcn.1400c93e0
cmp qword [rdi], 0xffffffffffffffff
mov ebx, eax
jne 0x1400c9620
mov qword [rdi], r15
cmp qword [rdi + 8], 0xffffffffffffffff
jne 0x1400c962b
mov qword [rdi + 8], r15
cmp eax, r15d
jle 0x1400c9836
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x580], r15
mov qword [rsp + 0x70], r15
cmp qword [rsi + 0x30], rdx
jne 0x1400c9683
mov eax, dword [rsp + 0x5a0]
mov r8, qword [rsp + 0x60]
cmp r8, rax
jb 0x1400c9683
mov rcx, qword [rdi]
lea rax, [rsp + 0x70]
mov r9d, 0x40
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x580], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x1400c9729
call fcn.1400c9234
cmp eax, r15d
je 0x1400c980c
mov rcx, qword [rdi]
call fcn.1400c92e4
cmp eax, r15d
je 0x1400c96cb
mov r8d, dword [rsp + 0x5a0]
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rdi]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [0x14011bfc0]
mov qword [rsp + 0x580], rax
jmp 0x1400c96d3
mov rax, qword [rsp + 0x580]
cmp rax, r15
jne 0x1400c9737
mov rcx, rsi
call fcn.1400c9244
cmp eax, r15d
je 0x1400c980c
mov r8d, dword [rsp + 0x5a0]
mov rcx, qword [rdi]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [0x14011bfc0]
mov qword [rsp + 0x580], rax
cmp rax, r15
je 0x1400c980c
mov r8, rax
mov rdx, r12
mov rcx, rsi
call fcn.1400c925c
cmp qword [rsp + 0x580], r15
je 0x1400c980c
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rdi]
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x580]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rsp + 0x580]
mov r9d, dword [rsp + 0x5a0]
lea rax, [rsp + 0x60]
mov qword [rsi + 0x30], rdx
mov rcx, qword [rdi]
mov r8, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp eax, r15d
je 0x1400c9807
mov rcx, qword [rsp + 0x580]
mov eax, dword [rsi + 0x28]
mov dword [rsp + 0xc0], 0x10000b
cmp rcx, qword [rsp + 0x68]
jne 0x1400c97bb
add rax, qword [rsi + 0x30]
jmp 0x1400c97be
add rax, rcx
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x110], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test r14b, 4
jne 0x1400c97e8
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp qword [rsp + 0x5d0], r15
jne 0x1400c9836
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400c9836
or ebx, 0xffffffff
jmp 0x1400c9811
mov ebx, 0xfffffffe
mov rcx, qword [rdi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], r15
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r15
lea r11, [rsp + 0x560]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret