Function at 0x140299a32
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movaps xmmword [rsp + 0x180], xmm6
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x178], rax
xor ebp, ebp
cmp qword [rcx + 0x18], 0
jne 0x140299a96
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140171860
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x180]
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdi, rcx
call fcn.14029a382
mov rbx, rax
mov rcx, rax
call fcn.14016f248
mov rsi, rax
movabs r12, 0xaaaaaaaaaaaaaaaa
test rbx, rbx
je 0x140299ce0
xor r14d, r14d
cmp byte [rdi + 0x20], 0
je 0x14029a165
mov rax, qword [rdi]
test rax, rax
je 0x14029a365
mov rax, qword [rax + 0x48]
lea rcx, [rsi + 0xc]
mov qword [rsi + 4], rax
lea rax, [rbx - 0xc]
lea rdx, [rsp + 0xb0]
mov qword [rdx], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x58], rcx
mov qword [rax], rcx
lea r13, [rdi + 8]
mov rbp, qword [rdi + 0x10]
movaps xmm6, xmmword [0x140301d60]
cmp rbp, r13
je 0x140299cdd
lea r15, [rbp + 0x10]
mov rcx, r15
call fcn.14029a498
test al, al
jne 0x140299b31
mov rbp, qword [rbp + 8]
jmp 0x140299b12
mov qword [rsp + 0x120], r12
movaps xmmword [rsp + 0x110], xmm6
cmp byte [rbp + 0x2f], 0
jns 0x140299b5e
mov rdx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x20]
lea rcx, [rsp + 0x110]
call fcn.14004da58
jmp 0x140299b79
lea rax, [rbp + 0x18]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x120], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x110], xmm0
mov rcx, r15
lea rdx, [rsp + 0x90]
lea r8, [rsp + 0xb0]
call fcn.14029a548
test al, al
je 0x140299c94
mov qword [rsp + 0x50], r13
cmp rbp, r13
mov r15, qword [rsp + 0x58]
je 0x14029a16c
mov qword [rsp + 0x50], rbp
movzx eax, byte [rsp + 0x127]
test al, al
cmovs rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x110]
lea rdx, [rsp + 0x110]
cmovns rcx, rdx
test rax, rax
je 0x140299be6
test rcx, rcx
je 0x14029a35c
movzx r8d, byte [rbp + 0x2f]
test r8b, r8b
jns 0x140299bfa
mov r8, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
jmp 0x140299bfe
lea rdx, [rbp + 0x18]
test r8, r8
je 0x140299c0c
test rdx, rdx
je 0x14029a35f
test rax, rax
je 0x140299c89
cmp r8, rax
jne 0x140299c89
xor r8d, r8d
movzx r9d, word [rdx + r8*2]
cmp r9w, word [rcx + r8*2]
jne 0x140299c8e
inc r8
cmp rax, r8
jne 0x140299c19
lea rcx, [rbp + 0x10]
lea rdx, [rsp + 0x90]
lea r8, [rsp + 0xb0]
mov r9, r15
call fcn.14029a5ec
test al, al
je 0x140299c9f
mov rax, qword [rsp + 0x50]
cmp rax, rbp
jne 0x140299c60
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
mov rcx, r13
lea rdx, [rsp + 0x80]
mov r8, rbp
call fcn.14029a6e6
mov rbp, qword [rsp + 0x80]
cmp rbp, r13
jne 0x140299bb1
jmp 0x14029a16c
cmp r8, rax
je 0x140299c2d
mov rbp, qword [rbp + 8]
jmp 0x140299c7b
mov r15, rsi
mov rsi, r12
xor r12d, r12d
jmp 0x140299cad
mov r15, rsi
mov rsi, r12
xor r12d, r12d
mov rbp, qword [rsp + 0x50]
cmp byte [rsp + 0x127], 0
jns 0x140299cc4
mov rcx, qword [rsp + 0x110]
call fcn.14016eccc
test r12b, r12b
mov r12, rsi
mov rsi, r15
jne 0x140299b12
mov ebp, 0x26
jmp 0x14029a1aa
mov dword [rsi], r14d
mov qword [rsp + 0x80], r12
mov rax, qword [rdi]
test rax, rax
je 0x14029a362
mov rcx, qword [rax]
lea r9, [rsp + 0x80]
mov rdx, rsi
mov r8, rbx
call fcn.14029bec1
mov ebp, 0x27
test al, al
je 0x14029a1aa
test rbx, rbx
jne 0x14029a2f8
cmp qword [rdi + 0x18], 0
je 0x14029a28e
mov rax, qword [rdi]
test rax, rax
je 0x14029a36b
mov rcx, qword [rax]
mov dword [rsp + 0x20], 1
mov r8d, 0x10000
mov qword [rsp + 0x50], rcx
xor edx, edx
mov r9d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, qword [rdi + 0x18]
shl r15, 6
lea r14, [r15 + 0x60]
cmp r14, 0x10001
jae 0x14029a36e
mov r12, rax
lea r13, [rsp + 0x110]
mov dword [r13], 0xaaaaaaaa
mov ebp, 0x10000
sub ebp, r14d
mov rcx, r13
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
movzx ebx, word [rsp + 0x110]
mov dword [rsp + 0x110], ebx
cmp ebp, ebx
jb 0x140299d8f
mov ecx, 0x800
mov r8d, 0x1000
mov edx, 0x800
mov rax, r8
shr rdx, 1
mov r8, rcx
cmp rcx, r14
mov rcx, rdx
jae 0x140299dbf
neg eax
and ebx, eax
mov eax, ebx
and eax, 0xf000
add r12, rax
add r15, 0x105f
and r15, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, qword [rsp + 0x50]
mov rdx, r12
mov r8, r15
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x14029a371
mov r15, rax
movaps xmm6, xmmword [0x140301d60]
movups xmmword [rsp + 0x120], xmm6
movups xmmword [rsp + 0x160], xmm6
movups xmmword [rsp + 0x150], xmm6
movups xmmword [rsp + 0x140], xmm6
movups xmmword [rsp + 0x130], xmm6
mov qword [rsp + 0x110], r14
mov dword [rsp + 0x128], 0
mov qword [rsp + 0x118], 0x20
lea rcx, [0x14035d3e0]
mov r8d, 0xe8
xor edx, edx
call fcn.140173760
lea rbp, [0x140325ea0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14029a1c0
mov qword [rsp + 0x78], rax
mov rax, qword [rdi]
test rax, rax
je 0x14029a374
and ebx, 0xfff
add r15, rbx
mov rbx, qword [rax]
mov ecx, 0x30
call fcn.14016ecd4
mov r12, rax
lea rax, [0x1402fdd00]
mov qword [r12], rax
mov qword [r12 + 0x18], 0
mov qword [r12 + 0x20], rbx
mov byte [r12 + 0x28], 1
mov dword [r12 + 0x2c], 0
lea rax, [rdi + 8]
mov r13, qword [rdi + 0x10]
mov qword [rsp + 0x58], rax
cmp r13, rax
je 0x14029a18a
lea rax, [rsp + 0x90]
cmp rax, rbp
seta al
lea rcx, [rsp + 0xa2]
cmp rcx, rbp
setbe cl
or cl, al
mov byte [rsp + 0x4f], cl
mov eax, 0x20
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rbx, rsi
movabs rsi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x100], rsi
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
lea rdx, [r13 + 0x10]
lea rcx, [rsp + 0xb0]
call fcn.14029965e
mov qword [rsp + 0xa0], rsi
movaps xmmword [rsp + 0x90], xmm6
mov byte [rsp + 0xa7], 9
cmp byte [rsp + 0x4f], 0
je 0x14029a368
movaps xmm0, xmmword [0x140325ea0]
movaps xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0xa0], 0x6c
movzx ecx, byte [rsp + 0xcf]
lea rax, [rsp + 0xb8]
test cl, cl
jns 0x140299fdc
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xb8]
test rcx, rcx
mov rsi, rbx
je 0x140299fed
test rax, rax
je 0x14029a37a
cmp rcx, 9
jne 0x14029a0f9
xor ecx, ecx
movzx edx, word [rax + rcx*2]
cmp dx, word [rsp + rcx*2 + 0x90]
jne 0x14029a0f9
inc rcx
cmp rcx, 9
jne 0x140299ff9
cmp dword [rsp + 0xb0], 1
jne 0x14029a0f9
cmp byte [rsp + 0xff], 0
lea rcx, [rsp + 0xe8]
jns 0x14029a03c
mov rcx, qword [rsp + 0xe8]
movsxd rax, dword [rsp + 0x60]
shl rax, 6
mov rdx, r14
sub rdx, qword [rsp + 0x68]
cmp byte [rsp + 0xe7], 0
lea r9, [rsp + 0xd0]
jns 0x14029a067
mov r9, qword [rsp + 0xd0]
mov qword [rsp + 0x70], r15
add r15, rax
add r15, 0x20
mov r8, qword [rsp + 0x100]
mov rax, qword [r12]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], 0
mov rcx, r12
mov rdx, qword [rsp + 0x78]
xor r8d, r8d
call qword [case.0x140211850.0]
test eax, eax
js 0x14029a139
movsxd rax, dword [rsp + 0xb4]
lea rcx, [0x14035d3e0]
mov qword [rcx + rax*8], r15
mov rax, qword [rsp + 0x60]
inc eax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x128], eax
mov rax, qword [rsp + 0x68]
add rax, 0x40
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x118], rax
mov bl, 1
jmp 0x14029a15e
xor ebx, ebx
mov ebp, 2
cmp byte [rsp + 0xa7], 0
jns 0x14029a117
mov rcx, qword [rsp + 0x90]
call fcn.14016eccc
lea rcx, [rsp + 0xb0]
call fcn.14029971e
test bl, bl
je 0x14029a18c
mov r13, qword [r13 + 8]
cmp r13, qword [rsp + 0x58]
jne 0x140299f2d
jmp 0x14029a18a
mov ebx, eax
call fcn.140109a5e
mov rax, qword [rax + 0x100]
mov ecx, ebx
call qword [case.0x140211850.0]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, 0x28
xor ebx, ebx
mov r15, qword [rsp + 0x70]
jmp 0x14029a100
xor eax, eax
jmp 0x140299adc
mov r15, rsi
mov rsi, r12
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x58], rax
inc r14d
mov r12b, 1
jmp 0x140299ca8
xor ebp, ebp
test r12, r12
je 0x14029a1a6
mov rax, qword [r12]
mov rax, qword [rax]
mov rcx, r12
mov edx, 1
call qword [case.0x140211850.0]
test ebp, ebp
je 0x14029a1c7
test rsi, rsi
je 0x140299a68
mov rcx, rsi
call fcn.14016efec
jmp 0x140299a68
mov ebp, 7
jmp 0x14029a1aa
lea rax, [rsp + 0x90]
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rax], rcx
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x110]
mov r9d, 0x20
mov rcx, qword [rsp + 0x50]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14029a2ee
cmp qword [rsp + 0x90], 0x20
jne 0x14029a2ee
lea rax, [rsp + 0x8c]
mov dword [rax], 0xaaaaaaaa
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x50]
mov rdx, r15
mov r8, r14
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14029a37d
mov qword [rsp + 0x20], 0xe8
lea r8, str.g_originals
lea r9, [0x14035d3e0]
lea rbx, [rsp + 0xb0]
mov rdx, rbx
call fcn.140281534
mov ebp, dword [rbx]
cmp byte [rbx + 0x1f], 0
jns 0x14029a286
mov rcx, qword [rsp + 0xb8]
call fcn.14016eccc
test ebp, ebp
jne 0x14029a1aa
mov rax, qword [rsp + 0x80]
mov qword [0x14035c578], rax
mov rcx, qword [rdi]
test rcx, rcx
je 0x14029a377
mov qword [rsp + 0x20], 8
lea r8, str.g_interceptions
lea r9, [0x14035c578]
lea rdi, [rsp + 0x110]
mov rdx, rdi
call fcn.140281534
mov ebp, dword [rdi]
cmp byte [rdi + 0x1f], 0
jns 0x14029a1aa
mov rcx, qword [rsp + 0x118]
call fcn.14016eccc
jmp 0x14029a1aa
mov ebp, 0x2a
jmp 0x14029a1aa
lea rax, [0x1402b9510]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rbx, [0x140325ea0]
lea r8, str.NtMapViewOfSection
mov rcx, rdi
mov rdx, rbx
mov r9d, 1
call fcn.140299808
lea rax, [0x1402b9580]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, str.NtUnmapViewOfSection
mov rcx, rdi
mov rdx, rbx
mov r9d, 1
call fcn.140299808
jmp 0x140299d2b
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3