Function at 0x140002410
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Enumerate pe sections
Read file via mapping

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0xa0
mov rax, qword [0x140037018]
xor rax, rsp
mov qword [rsp + 0x80], rax
movdqa xmm0, xmmword [str.C:WindowsSyste]
xor r15d, r15d
mov rbx, rcx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x70], 0x5c32336d
lea r8d, [r15 + 1]
mov dword [rsp + 0x74], 0x6c64746e
mov edx, 0x80000000
mov dword [rsp + 0x78], 0x6c642e6c
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x7c], 0x6c
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000272e
mov qword [rsp + 0x28], r15
lea r8d, [r15 + 2]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov qword [rsp + 0xc8], rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x48], rax
mov rsi, rax
test rax, rax
je 0x140002721
xor r9d, r9d
mov qword [rsp + 0xd0], r12
xor r8d, r8d
mov qword [rsp + 0x20], r15
lea edx, [r15 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
je 0x140002710
mov rdx, rbx
mov rcx, rax
call fcn.140002120
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140002707
movsxd rcx, dword [r12 + 0x3c]
add rcx, r12
mov r9d, dword [rcx + 0xa0]
test r9d, r9d
je 0x140002707
movzx eax, word [rcx + 6]
movzx ebx, word [rcx + 0x14]
mov r11d, eax
add rbx, 0x18
mov qword [rsp + 0x90], r14
add rbx, rcx
sub r11, 1
mov qword [rsp + 0x50], rbx
lea r14d, [rax - 1]
mov r10d, r14d
js 0x1400026ff
lea rdx, [r11*4 + 2]
mov r8, r11
add rdx, r11
lea rdx, [rbx + rdx*8]
mov ecx, dword [rdx - 4]
cmp ecx, r9d
ja 0x140002582
add ecx, dword [rdx]
cmp r9d, ecx
jbe 0x140002594
dec r10d
sub rdx, 0x28
sub r8, 1
jns 0x140002573
jmp 0x1400026ff
mov qword [rsp + 0xc0], rbp
mov ebp, r15d
mov qword [rsp + 0x98], r13
movsxd rax, r10d
lea rcx, [rax + rax*4]
mov r13d, dword [rbx + rcx*8 + 0x14]
sub r13d, dword [rbx + rcx*8 + 0xc]
add r13d, r9d
add r13, r12
mov r9d, dword [r13]
test r9d, r9d
je 0x1400026ef
mov rdi, r15
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
lea rax, [r11*4 + 2]
mov r10d, r14d
add rax, r11
mov r8, r11
lea rax, [rbx + rax*8]
mov edx, dword [rax - 4]
cmp edx, r9d
ja 0x140002604
add edx, dword [rax]
cmp r9d, edx
jbe 0x140002642
dec r10d
sub rax, 0x28
sub r8, 1
jns 0x1400025f5
mov rcx, rsi
lea rbx, [rcx + r12]
cmp rbx, qword [rsp + 0x58]
je 0x140002657
mov rbx, qword [rsp + 0x50]
inc ebp
mov edi, ebp
lea rax, [rbp*2]
add rax, rbp
mov r9d, dword [r13 + rax*4]
test r9d, r9d
jne 0x1400025e0
jmp 0x1400026e5
movsxd rax, r10d
lea rcx, [rax + rax*4]
mov eax, dword [rbx + rcx*8 + 0x14]
sub eax, dword [rbx + rcx*8 + 0xc]
lea ecx, [r9 + rax]
jmp 0x140002614
lea rax, [rdi + rdi*2]
mov r8d, dword [r13 + rax*4 + 4]
test r8d, r8d
je 0x1400026b2
mov r9, qword [rsp + 0x50]
lea rdx, [r11*4 + 2]
add rdx, r11
lea rdx, [r9 + rdx*8]
nop dword [rax]
mov ecx, dword [rdx - 4]
cmp ecx, r8d
ja 0x14000268f
add ecx, dword [rdx]
cmp r8d, ecx
jbe 0x14000269e
dec r14d
sub rdx, 0x28
sub r11, 1
jns 0x140002680
jmp 0x1400026b2
movsxd rax, r14d
lea rcx, [rax + rax*4]
mov esi, dword [r9 + rcx*8 + 0x14]
sub esi, dword [r9 + rcx*8 + 0xc]
add esi, r8d
sub rsi, rbx
mov r9d, 0x40
add rsi, r12
mov r8d, 0x3000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x1400026e5
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140009570
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xc0]
mov r14, qword [rsp + 0x90]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xc8]
test rdi, rdi
je 0x140002737
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r15
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400076b0
add rsp, 0xa0
pop r15
pop rdi
pop rbx
ret