Function at 0x14006d1c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2b8
mov ebx, ecx
mov cl, 1
nop word [rax + rax]
movzx eax, byte [0x140178ba1]
test al, al
jne 0x14006d1e0
xor eax, eax
lock cmpxchg byte [0x140178ba1], cl
je 0x14006d1fb
pause
jmp 0x14006d1e0
mov r14, qword [0x1400c7288]
mov rsi, qword [0x1400c7290]
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r15, [0x1400c67c0]
nop dword [rax + rax]
mov ecx, dword [r15 + rdi*4 + 0x10]
cmp ecx, eax
je 0x14006d267
mov ecx, dword [r15 + rdi*4 + 0x14]
cmp ecx, eax
je 0x14006d258
mov ecx, dword [r15 + rdi*4 + 0x18]
cmp ecx, eax
je 0x14006d25d
mov ecx, dword [r15 + rdi*4 + 0x1c]
cmp ecx, eax
je 0x14006d263
add rdi, 4
cmp rdi, 0x80
jne 0x14006d220
mov eax, 0xffffffff
jmp 0x14006d269
inc rdi
jmp 0x14006d267
add rdi, 2
jmp 0x14006d267
add rdi, 3
mov eax, edi
shl rax, 4
mov rcx, qword [rax + r15 + 0x218]
mov rdi, qword [rax + r15 + 0x210]
add rdi, rcx
add rcx, rsi
add rcx, 0xb
mov qword [rax + r15 + 0x218], rcx
test rsi, rsi
je 0x14006d2ab
mov rcx, rdi
mov rdx, r14
mov r8, rsi
call fcn.140091e40
mov byte [rdi + rsi], 0x2f
inc rsi
jmp 0x14006d2ad
xor esi, esi
movabs rax, 0x382e6d6f74737563
mov qword [rdi + rsi], rax
mov byte [rdi + rsi + 8], Ordinal_101
add rsi, 9
test bl, bl
je 0x14006d487
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
lea rbx, [rsi*4 + 2]
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop word [rax + rax]
mov ecx, dword [r15 + r14*4 + 0x10]
cmp ecx, eax
je 0x14006d337
mov ecx, dword [r15 + r14*4 + 0x14]
cmp ecx, eax
je 0x14006d328
mov ecx, dword [r15 + r14*4 + 0x18]
cmp ecx, eax
je 0x14006d32d
mov ecx, dword [r15 + r14*4 + 0x1c]
cmp ecx, eax
je 0x14006d333
add r14, 4
cmp r14, 0x80
jne 0x14006d2f0
mov eax, 0xffffffff
jmp 0x14006d33a
inc r14
jmp 0x14006d337
add r14, 2
jmp 0x14006d337
add r14, 3
mov eax, r14d
shl rax, 4
mov rcx, qword [rax + r15 + 0x218]
mov r8, qword [rax + r15 + 0x210]
add r8, rcx
add rbx, rcx
mov qword [rax + r15 + 0x218], rbx
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x38]
call fcn.1400030a0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14006d380
mov rax, qword [rsp + 0x28]
mov word [rcx + rax], 0
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14006d487
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x60]
call fcn.14000c700
cmp eax, 0x68
jb 0x14006d487
mov ebx, eax
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop word cs:[rax + rax]
mov ecx, dword [r15 + r14*4 + 0x10]
cmp ecx, eax
je 0x14006d417
mov ecx, dword [r15 + r14*4 + 0x14]
cmp ecx, eax
je 0x14006d408
mov ecx, dword [r15 + r14*4 + 0x18]
cmp ecx, eax
je 0x14006d40d
mov ecx, dword [r15 + r14*4 + 0x1c]
cmp ecx, eax
je 0x14006d413
add r14, 4
cmp r14, 0x80
jne 0x14006d3d0
mov eax, 0xffffffff
jmp 0x14006d41a
inc r14
jmp 0x14006d417
add r14, 2
jmp 0x14006d417
add r14, 3
mov eax, r14d
shl rax, 4
mov rcx, qword [rax + r15 + 0x218]
mov rdx, qword [rax + r15 + 0x210]
add rdx, rcx
add rbx, rcx
mov qword [rax + r15 + 0x218], rbx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x20]
call fcn.1400047b0
test al, al
je 0x14006d487
mov r14, qword [rsp + 0x20]
movzx eax, word [r14 + 0xc]
xor eax, 0x300
movzx ecx, byte [r14 + 0xe]
xor ecx, 2
or cx, ax
je 0x14006d766
mov dword [rsp + 0x20], 0x20300
vmovups xmm0, xmmword [0x1400c7288]
vmovaps xmmword [rsp + 0x60], xmm0
lea rdx, str.__custom.8
lea rbx, [rsp + 0x50]
lea r8, [rsp + 0x60]
mov rcx, rbx
call fcn.140002760
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14004b0f0
test al, al
je 0x14006d5c1
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x60]
call fcn.14000c700
mov edx, eax
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x60]
call fcn.1400047b0
test al, al
je 0x14006d5d1
mov eax, dword [0x140178a54]
mov rcx, qword [0x140178a48]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
vmovups xmm0, xmmword [rsp + 0x60]
vmovups xmmword [0x140178a48], xmm0
mov rax, qword [0x140178a48]
mov qword [0x140178a40], rax
cmp dword [rax + 8], 1
jne 0x14006d6a3
mov ecx, dword [rax + 0x38]
mov r10d, dword [rax + 0x40]
test r10d, r10d
je 0x14006d5e6
mov edx, dword [rax + 0x30]
lea r8, [rax + rdx]
mov r9d, dword [rax + 0x44]
add r9, rax
add r9, 0x20
xor r11d, r11d
jmp 0x14006d5ab
add rsi, rax
mov r10d, dword [r9 - 0x20]
add qword [r10 + rsi], r8
mov r10d, dword [rax + 0x40]
inc r11d
add r9, 0x28
cmp r11d, r10d
jae 0x14006d5e3
movzx edi, byte [r9]
mov rsi, rdx
cmp edi, 1
je 0x14006d590
cmp edi, 3
jne 0x14006d59f
mov rsi, rcx
jmp 0x14006d590
lock or qword [0x1400c5c48], 0x20
xor esi, esi
jmp 0x14006d748
test rsi, rsi
je 0x14006d71e
mov byte [rdi + rsi], 0
jmp 0x14006d720
mov ecx, dword [rax + 0x38]
cmp dword [rax + 0x48], 0
je 0x14006d614
add rcx, rax
mov edx, dword [rax + 0x4c]
add rdx, rax
xor r8d, r8d
nop dword [rax + rax]
mov r9d, dword [rdx]
add qword [rcx + r9], rcx
add rdx, 0x28
inc r8d
cmp r8d, dword [rax + 0x48]
jb 0x14006d600
mov r8d, dword [rax + 0x24]
test r8, r8
je 0x14006d650
mov ecx, dword [rax + 0x20]
add rcx, rax
mov edx, dword [rax + 0x28]
add rdx, rax
lea r8, [rcx + r8*8]
lea r9, [0x1400618f0]
nop word cs:[rax + rax]
mov r10, qword [rcx]
mov qword [rdx + r10], r9
add rcx, 8
cmp rcx, r8
jb 0x14006d640
mov ecx, dword [rax + 0x50]
add rcx, rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x38], 0x20
mov edx, dword [rax + 0x54]
mov dword [rsp + 0x34], edx
test edx, edx
je 0x14006d683
xor edx, edx
add qword [rcx], rax
inc rdx
mov r8d, dword [rax + 0x54]
add rcx, 0x20
cmp rdx, r8
jb 0x14006d670
mov rcx, qword [rsp + 0x20]
mov qword [0x140178b78], rcx
mov ecx, dword [rsp + 0x38]
mov dword [0x140178b80], ecx
mov ecx, dword [rsp + 0x34]
mov dword [0x140178b84], ecx
test byte [rax + 0x64], 2
je 0x14006d6c4
mov ecx, dword [rax + 0x60]
add rcx, rax
je 0x14006d6c4
cmp dword [rax + 8], 1
jne 0x14006d6c4
mov qword [0x1400e4b38], 0
call rcx
mov rax, qword [0x140178c28]
movsxd rcx, dword [0x140178c34]
imul rcx, rcx, 0x248
add rcx, rax
jmp 0x14006d6e6
add rax, 0x248
cmp rax, rcx
jae 0x14006d719
cmp byte [rax + 0x34], 1
jne 0x14006d6e0
mov rdx, qword [0x140178a40]
test rdx, rdx
je 0x14006d6e0
test byte [rdx + 0x64], 4
je 0x14006d6e0
mov r8d, dword [rdx + 0x58]
add r8, rdx
je 0x14006d6e0
mov rdx, qword [rax + 0x38]
lock or word [rdx + 2], 0x400
jmp 0x14006d6e0
mov sil, 1
jmp 0x14006d748
xor edi, edi
lea r8, str.Failed_to_load__s.
xor esi, esi
xor ecx, ecx
xor edx, edx
mov r9, rdi
call fcn.140007a90
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
xchg byte [0x140178ba1], al
mov eax, esi
add rsp, 0x2b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, dword [r14 + 0x54]
test rcx, rcx
je 0x14006d4cb
mov rax, rcx
mov r12d, dword [r14 + 0x50]
add r12, r14
shl rax, 5
add rax, r12
mov qword [rsp + 0x48], rax
nop dword [rax]
mov r13, qword [r12 + 8]
mov rbp, qword [r12]
add rbp, r14
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r13
lea r15, [rsp + 0x60]
mov rcx, r15
call fcn.14000c700
mov ebx, eax
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r13
mov rcx, r15
call fcn.140004660
cmp qword [r12 + 0x18], rbx
jne 0x14006d487
cmp rax, qword [r12 + 0x10]
jne 0x14006d487
add r12, 0x20
cmp r12, qword [rsp + 0x48]
jb 0x14006d790
jmp 0x14006d4cb