Function at 0x40caa0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov edi, dword [0x00423a8c]
mov dword [0x0041d6e0], 0
test edi, edi
je 0x40ce10
lea rdx, [sym.v_segmentation_fault_handler]
mov ecx, 0xb
call sub.msvcrt.dll_signal
mov edx, 1
mov ecx, 0x18
call sym.GC_malloc_kind_global
mov dword [rsp + 0x50], 0
mov r8, qword [rsp + 0x50]
movabs rdx, 0x100000007
lea rcx, str.unknown
mov qword [rsp + 0x60], rdx
mov qword [rax + 0x10], rdx
lea rbx, [rsp + 0x4c]
mov qword [rsp + 0x58], rcx
mov qword [rax], r8
mov qword [rax + 8], rcx
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ecx, 0xfde9
mov dword [0x0044e430], eax
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rcx, [sym.restore_codepage]
call sym.atexit
mov ecx, 1
mov dword [rsp + 0x4c], 0
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov esi, dword [rsp + 0x4c]
test esi, esi
jle 0x40cbbb
mov ecx, 0xfffffff5
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
call rdi
mov edx, 7
mov rsi, qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov rcx, rax
call rsi
mov ecx, 0xfffffff4
call rdi
mov edx, 7
mov rcx, rax
call rsi
mov ecx, 1
mov rsi, qword [sym.__acrt_iob_func]
call rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_setbuf
mov ecx, 2
call rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_setbuf
lea rdx, [sym.unhandled_exception_handler]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
lea rdi, str.0123456789abcdefghijklmnopqrstuvwxyz
mov ecx, 1
movabs rax, 0x1000000c8
lea rdx, str.00102030405060708090011121314151617181910212223242526272829203132333435363738393041424344454647484940515253545556575859506162636465666768696071727374757677787970818283848586878889809192939495969798999
mov qword [0x0044e468], rax
mov qword [0x0044e460], rdx
mov qword [0x0044e450], rdi
movabs rdi, 0x100000024
mov qword [0x0044e440], rdx
mov edx, 1
mov qword [0x0044e448], rax
movabs rax, 0x8000000000000000
mov qword [0x0044e458], rdi
mov qword [0x0044e438], rax
call sym.GC_malloc_kind_global
mov ecx, 4
mov dword [rsp + 0x4c], 0
call sym.vcalloc_noscan
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
mov rsi, rax
mov edx, 0x20
mov dword [rax], 0xc3cc9090
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9, rbx
mov r8d, 0x40
mov edx, 4
mov rdi, rax
mov eax, dword [rsi]
mov rcx, rdi
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r11d, dword [0x0044e470]
test r11d, r11d
je 0x40ceb0
mov r8d, dword [0x00423edc]
xor esi, esi
mov r9d, dword [0x00423a88]
test r8d, r8d
sete sil
add rsi, 0xf
test r9d, r9d
jne 0x40cd80
lea rbp, [0x00423f00]
mov rdx, qword [0x0041d740]
mov rax, qword [rbp + rsi*8 + 0xfb8]
lea rdx, [rdx + rax*8]
mov rbx, qword [rdx]
test rbx, rbx
je 0x40ce70
mov rcx, qword [rbx]
shl rax, 4
mov qword [rdx], rcx
mov qword [rbx], 0
mov ecx, dword [0x00423a88]
add qword [0x00423f40], rax
add qword [0x00423a48], rax
test ecx, ecx
jne 0x40cdd0
mov qword [rbx], rdi
mov eax, dword [0x00423ee8]
mov qword [rbx + 8], 0
test eax, eax
jne 0x40cda0
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov r9, rbx
mov qword [rsp + 0x28], 0
lea r8, [sym.GC_win32_start]
mov dword [0x00423a88], 1
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x40cdf0
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [0x00423a60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x40ccbf
mov rcx, rbx
mov edx, 1
shr rcx, 0xc
and ecx, 0x3ffff
mov rax, rcx
shl rdx, cl
shr rax, 6
add rax, 0x1c79
lock or qword [rbp + rax*8], rdx
jmp 0x40cd27
lea rcx, [0x00423a60]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x40cd12
mov rcx, rbx
mov qword [rsp + 0x38], rax
call sym.GC_free
mov rax, qword [rsp + 0x38]
jmp 0x40cd5f
lea rcx, [0x0041ebf0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x40ce50
lea rdx, [0x0041ec00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40ce50
lea rcx, [0x00423a60]
mov edx, 0xfa0
call rax
jmp 0x40ce5d
lea rcx, [0x00423a60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call sym.GC_init.part.47
jmp 0x40cac0
mov edx, dword [0x00423a88]
test edx, edx
jne 0x40cf10
mov edx, 2
mov rcx, rsi
call sym.GC_generic_malloc
test rax, rax
mov rbx, rax
jne 0x40cd12
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x40cd5f
mov r10d, dword [0x00423a8c]
mov dword [0x0044e470], 1
test r10d, r10d
jne 0x40cc9b
lea rcx, [0x0041ebf0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x40cf22
lea rdx, [0x0041ec00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40cf22
lea rcx, [0x00423a60]
mov edx, 0xfa0
call rax
call sym.GC_init.part.47
jmp 0x40cc9b
lea rcx, [0x00423a60]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x40ce7e
lea rcx, [0x00423a60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x40ceff