Function at 0x140021260
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x518
mov r13, r9
mov r12, r8
mov rbp, rdx
mov r15, rcx
movzx ebx, byte [rsp + 0x580]
test bl, bl
mov eax, 0x80
mov edi, 0x1e
cmovne rdi, rax
mov dword [rsp + 0x20], 0x40
xor esi, esi
xor edx, edx
mov r8, rdi
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x1400214cd
mov r14, rax
mov rcx, rbp
test bl, bl
je 0x1400213be
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1400214b1
lea rsi, [rsp + 0x40]
mov r8d, 0x4d0
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x70], 0x10001f
mov rcx, rbp
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400214a8
mov rax, qword [rsp + 0x138]
mov qword [0x140059067], rax
lea r8, [0x140059030]
mov qword [0x140059051], r13
mov qword [0x14005905b], r12
lea rsi, [rdi + r14 - 1]
mov qword [0x14005907e], rsi
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, r14
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400214a8
mov rbx, qword [rsp + 0x138]
mov qword [rsp + 0x138], r14
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1400214a8
mov eax, 0xffffffff
mov rdi, qword [sym.imp.KERNEL32.dll_ResumeThread]
nop dword [rax + rax]
cmp eax, 2
jb 0x1400214e3
mov rcx, rbp
call rdi
cmp eax, 0xffffffff
jne 0x140021390
mov qword [rsp + 0x138], rbx
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
jmp 0x1400214a8
call qword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
cmp eax, 0xffffffff
je 0x1400214b1
lea rcx, [rsp + 0x44]
mov r8d, 0x2c8
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x1003f
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x1400214a8
mov eax, dword [rsp + 0xf8]
mov dword [0x1400590b1], eax
lea r8, [0x1400590b0]
mov dword [0x1400590b8], r13d
mov dword [0x1400590bd], r12d
lea eax, [rdi + r14 - 1]
mov dword [0x1400590c7], eax
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, r14
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400214a8
mov ebx, dword [rsp + 0xf8]
mov dword [rsp + 0xf8], r14d
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
test eax, eax
je 0x1400214a8
mov eax, 0xffffffff
mov rsi, qword [sym.imp.KERNEL32.dll_ResumeThread]
nop word cs:[rax + rax]
cmp eax, 2
jb 0x140021553
mov rcx, rbp
call rsi
cmp eax, 0xffffffff
jne 0x140021480
mov dword [rsp + 0xf8], ebx
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor esi, esi
test r15, r15
je 0x1400214cd
mov rcx, r15
mov rdx, r14
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, esi
add rsp, 0x518
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x38], rbx
mov rbx, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rbx
mov rdi, rax
add rdi, 0x1388
call rbx
cmp rax, rdi
jae 0x1400215dc
mov r13, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140021529
mov ecx, 0xa
call r12
call rbx
cmp rax, rdi
jae 0x1400215dc
mov qword [rsp + 0x20], 0
mov r9d, 1
mov rcx, r15
mov rdx, rsi
lea r8, [rsp + 0x37]
call r13
test eax, eax
je 0x140021516
cmp byte [rsp + 0x37], 0x69
jne 0x140021516
jmp 0x1400215cb
mov dword [rsp + 0x38], ebx
mov rbx, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rbx
mov rsi, rax
add rsi, 0x1388
call rbx
cmp rax, rsi
jae 0x1400215fc
mov eax, r14d
add rdi, rax
dec rdi
lea r12, [rsp + 0x37]
mov r13, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400215a5
mov ecx, 0xa
call rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, rsi
jae 0x1400215fc
mov qword [rsp + 0x20], 0
mov r9d, 1
mov rcx, r15
mov rdx, rdi
mov r8, r12
call r13
test eax, eax
je 0x140021593
cmp byte [rsp + 0x37], 0x69
jne 0x140021593
mov sil, 1
test r15, r15
jne 0x1400214b8
jmp 0x1400214cd
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x138], rax
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
jmp 0x1400214b1
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0xf8], eax
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
jmp 0x1400214b1