Function at 0x140012960
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, qword [rcx]
movsxd r12, dword [rbp + 0x3c]
add r12, rbp
mov edx, dword [r12 + 0x50]
mov r9d, 0x40
mov r8d, 0x3000
mov ecx, 0
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x140012d10
lea rax, [r12 + 0x18]
mov qword [rsp + 0x28], rax
movzx ebx, word [r12 + 0x14]
add rbx, rax
cmp word [r12 + 6], 0
je 0x1400129e9
mov esi, 0
mov ecx, dword [rbx + 0xc]
add rcx, rdi
mov edx, dword [rbx + 0x14]
add rdx, rbp
mov r8d, dword [rbx + 0x10]
call sub.msvcrt.dll_memcpy
add rbx, 0x28
add esi, 1
movzx eax, word [r12 + 6]
cmp eax, esi
ja 0x1400129c3
mov r15d, dword [r12 + 0x90]
add r15, rdi
mov ecx, dword [r15 + 0xc]
test ecx, ecx
je 0x140012aa8
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x20], rax
mov r13, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, ecx
add rcx, rdi
mov rax, qword [rsp + 0x20]
call rax
mov rbp, rax
test rax, rax
je 0x140012d17
mov ebx, dword [r15]
add rbx, rdi
mov esi, dword [r15 + 0x10]
add rsi, rdi
mov rdx, qword [rbx]
test rdx, rdx
je 0x140012a98
mov r14, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140012a74
movzx edx, dx
mov rcx, rbp
call r14
test rax, rax
je 0x140012d1e
movzx edx, byte [rdi]
sub rax, rdx
mov qword [rsi], rax
add rbx, 8
add rsi, 8
mov rdx, qword [rbx]
test rdx, rdx
je 0x140012a98
test rdx, rdx
js 0x140012a49
lea rdx, [rdi + rdx + 2]
mov rcx, rbp
call r13
test rax, rax
je 0x140012d25
movzx edx, byte [rdi]
sub rax, rdx
mov qword [rsi], rax
jmp 0x140012a64
add r15, 0x14
mov ecx, dword [r15 + 0xc]
test ecx, ecx
jne 0x140012a13
mov r9, rdi
sub r9, qword [r12 + 0x30]
je 0x140012ac9
mov r8d, dword [r12 + 0xb0]
add r8, rdi
mov eax, dword [r8 + 4]
test eax, eax
jne 0x140012b7b
cmp dword [r12 + 0xd4], 0
je 0x140012b05
mov eax, dword [r12 + 0xd0]
mov rbx, qword [rdi + rax + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x140012b05
mov r8d, 0
mov edx, 1
mov rcx, rdi
call rax
add rbx, 8
mov rax, qword [rbx]
test rax, rax
jne 0x140012ae9
movzx ebx, word [r12 + 0x14]
add rbx, qword [rsp + 0x28]
cmp word [r12 + 6], 0
je 0x140012ceb
mov esi, 0
lea r14, [rsp + 0x3c]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, 4
jmp 0x140012c1f
mov ecx, dword [r8]
and edx, 0xfff
add rdx, rcx
add qword [rdi + rdx], r9
add rax, 2
cmp rax, r10
je 0x140012b68
movzx edx, word [rax]
mov ecx, edx
shr cx, 0xc
cmp cx, 3
je 0x140012b38
cmp cx, 0xa
jne 0x140012b48
jmp 0x140012b38
mov eax, dword [r8 + 4]
add r8, rax
mov eax, dword [r8 + 4]
test eax, eax
je 0x140012ac9
cmp dword [r8], 0
je 0x140012ac9
mov edx, eax
sub rdx, 8
shr rdx, 1
test edx, edx
je 0x140012b68
lea rax, [r8 + 8]
lea edx, [rdx - 1]
lea r10, [r8 + rdx*2 + 0xa]
jmp 0x140012b51
cmp byte [rbx + 2], 0x64
je 0x140012bc9
cmp byte [rbx + 2], 0x65
jne 0x140012bcf
cmp byte [rbx + 3], 0x6c
jne 0x140012c0a
cmp byte [rbx + 4], 0x6f
jne 0x140012c0a
cmp byte [rbx + 5], 0x63
jne 0x140012c0a
mov r8d, 2
jmp 0x140012cd7
cmp byte [rbx + 3], 0x61
je 0x140012be9
cmp byte [rbx + 2], 0x73
jne 0x140012c0a
cmp byte [rbx + 3], 0x72
jne 0x140012c0a
mov r8d, ebp
cmp byte [rbx + 4], 0x63
jne 0x140012c0a
jmp 0x140012cd7
cmp byte [rbx + 4], 0x74
jne 0x140012bcf
cmp byte [rbx + 5], 0x61
jne 0x140012bcf
mov r8d, 2
jmp 0x140012cd7
cmp al, 0x78
jne 0x140012c6c
cmp byte [rbx + 2], 0x64
je 0x140012c52
add rbx, 0x28
add esi, 1
movzx eax, word [r12 + 6]
cmp eax, esi
jbe 0x140012ceb
movzx eax, byte [rbx + 1]
cmp al, 0x72
je 0x140012ba0
cmp al, 0x70
jne 0x140012c00
cmp byte [rbx + 2], 0x64
jne 0x140012c0a
cmp byte [rbx + 3], 0x61
jne 0x140012c0a
cmp byte [rbx + 4], 0x74
jne 0x140012c0a
cmp byte [rbx + 5], 0x61
jne 0x140012c0a
mov r8d, 2
jmp 0x140012cd7
cmp byte [rbx + 3], 0x61
jne 0x140012c0a
cmp byte [rbx + 4], 0x74
jne 0x140012c0a
cmp byte [rbx + 5], 0x61
jne 0x140012c0a
mov r8d, 2
jmp 0x140012cd7
cmp al, 0x64
jne 0x140012c87
cmp byte [rbx + 2], 0x61
jne 0x140012c0a
cmp byte [rbx + 3], 0x74
jne 0x140012c0a
cmp byte [rbx + 4], 0x61
jne 0x140012c0a
mov r8d, ebp
jmp 0x140012cd7
cmp al, 0x69
jne 0x140012cb8
cmp byte [rbx + 2], 0x64
jne 0x140012c0a
cmp byte [rbx + 3], 0x61
jne 0x140012c0a
cmp byte [rbx + 4], 0x74
jne 0x140012c0a
cmp byte [rbx + 5], 0x61
jne 0x140012c0a
mov r8d, ebp
jmp 0x140012cd7
cmp al, 0x74
jne 0x140012c0a
cmp byte [rbx + 2], 0x6c
jne 0x140012c0a
cmp byte [rbx + 3], 0x73
jne 0x140012c0a
mov r8d, ebp
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 0xc]
add rcx, rdi
mov r9, r14
call r13
jmp 0x140012c0a
mov eax, dword [r12 + 0x28]
add rax, rdi
call rax
mov r8d, 0x8000
mov edx, 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
jmp 0x140012d2a
mov eax, 0
jmp 0x140012d2a
mov eax, 0
jmp 0x140012d2a
mov eax, 0
jmp 0x140012d2a
mov eax, 0
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret