Function at 0x140012c90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
mov eax, 0x10600
call fcn.140014430
sub rsp, rax
xor r15d, r15d
mov r12, r8
mov rdi, rcx
mov r8d, edx
mov dword [rcx], r15d
mov ecx, 0x1f0fff
xor edx, edx
mov rbp, r9
mov r13d, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, str.kernel32
mov dword [rsp + 0x10630], r15d
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x140012d0b
lea rdx, [rsp + 0x10630]
mov rcx, rsi
call rax
cmp dword [rsp + 0x10630], r15d
je 0x140012d25
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14001300c
cmp rsi, r15
je 0x140013001
lea rcx, [rsp + 0x68]
xor edx, edx
mov r8d, 0x82c0
mov qword [rsp + 0x60], r15
call sub.msvcrt.dll_memset
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [0x140017770]
lea rcx, [rsp + 0x40]
mov rdx, rax
mov rbx, rax
mov qword [rsp + 0x40], r15
call fcn.140011124
lea r8, [0x140017780]
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0xe0], rax
call fcn.140011124
mov rdx, qword [rsp + 0x10680]
mov ebx, 0x68
cmp rdx, r15
mov qword [rsp + 0xe8], rax
je 0x140012db1
lea rcx, [rsp + 0x78]
mov r8, rbx
call sub.msvcrt.dll_memcpy
cmp rbp, r15
mov dword [rsp + 0x78], ebx
mov ebx, 0x2000
je 0x140012dd4
lea rcx, [rsp + 0xf8]
mov r8d, ebx
mov rdx, rbp
call fcn.140009bc4
jmp 0x140012dde
mov word [rsp + 0xf8], 1
cmp r12, r15
je 0x140012df8
lea rcx, [rsp + 0x40fa]
mov r8d, ebx
mov rdx, r12
call fcn.140009bc4
jmp 0x140012e02
mov word [rsp + 0x40fa], 1
mov rdx, qword [rsp + 0x10678]
cmp rdx, r15
je 0x140012e24
lea rcx, [rsp + 0x80fc]
mov r8d, 0x104
call fcn.140009bc4
jmp 0x140012e2e
mov word [rsp + 0x80fc], 1
mov eax, dword [rsp + 0x10668]
mov ebx, 0x1000
xor edx, edx
mov r8d, 0x82c8
mov rcx, rsi
mov r9d, ebx
mov dword [rsp + 0x8324], eax
mov dword [rsp + 0x8320], r15d
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, ebx
mov ebx, 0x800
xor edx, edx
mov rcx, rsi
mov r8, rbx
mov r12, rax
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp r12, r15
mov rbp, rax
je 0x140013001
cmp rax, r15
je 0x140013001
lea r8, [0x140012bc0]
mov r9, rbx
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r8, [rsp + 0x60]
mov r9d, 0x82c8
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rsp + 0x10630]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x10630], r15d
mov qword [rsp + 0x20], rbp
call fcn.140011fcc
cmp rax, r15
mov rbx, rax
je 0x140012f40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0x7d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140012f48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
lea rcx, [rsp + 0x8338]
xor edx, edx
mov r8d, 0x82c0
mov qword [rsp + 0x8330], r15
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x8330]
mov r9d, 0x82c8
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp rbx, r15
je 0x140012fef
mov rcx, qword [rsp + 0x10688]
mov eax, dword [rsp + 0x83c4]
mov r13d, dword [rsp + 0x83c0]
cmp rcx, r15
mov dword [rdi], eax
je 0x140012fef
lea rdx, [rsp + 0x8330]
mov rax, qword [rdx]
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
mov rcx, qword [rsp + 0x48]
cmp rcx, r15
je 0x140013009
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140013009
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov eax, r13d
lea r11, [rsp + 0x10600]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret