Function at 0x10007260
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov qword [r11 + 8], rbx
mov ebx, dword [rcx + 0x3c]
mov qword [r11 - 0x10], r13
cmp ebx, edx
mov r13, rcx
jae 0x10007565
test ebx, ebx
je 0x10007565
cmp dword [rbx + rcx], 0x4550
mov qword [r11 - 0x18], r14
mov r14, rbx
jne 0x10007561
cmp word [rbx + rcx + 0x18], 0x20b
jne 0x10007561
xor eax, eax
mov qword [r11 + 0x10], rbp
movzx ebp, word [rbx + rcx + 6]
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x60], 0
mov rdi, qword [rbx + rcx + 0x30]
mov esi, dword [rbx + rcx + 0x50]
mov qword [r11 - 0x20], r15
lea r8d, [rax + 0x30]
lea rdx, [r11 - 0x60]
mov rcx, rdi
mov r15, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp qword [rsp + 0x30], 0
jne 0x10007319
cmp dword [rsp + 0x4c], 1
jne 0x10007319
cmp dword [rsp + 0x48], 0x10000
jne 0x10007319
cmp qword [rsp + 0x40], rsi
ja 0x1000731b
xor edi, edi
mov r9d, 0x40
mov r8d, 0x2000
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x10007525
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [rbp + rbp*4]
lea edx, [rbx + rcx*8 + 0x108]
mov rcx, rax
mov rdi, rax
movsxd r8, edx
mov rdx, r13
call sub.MSVCR80.dll_memcpy
test ebp, ebp
jle 0x100073ae
lea rbx, [rbx + r13 + 0x11c]
mov rsi, rbp
nop
nop
nop
mov edx, dword [rbx]
mov ecx, dword [rbx - 8]
mov r8d, dword [rbx - 4]
add rdx, r13
add rcx, rdi
call sub.MSVCR80.dll_memcpy
add rbx, 0x28
sub rsi, 1
jne 0x10007390
mov ebp, dword [r14 + r13 + 0x90]
mov qword [rsp + 0x80], r12
mov r12d, 1
add rbp, rdi
add rbp, 0x10
cmp dword [rbp], 0
je 0x1000746c
test r12d, r12d
je 0x10007507
mov ecx, dword [rbp - 4]
add rcx, rdi
cmp byte [rcx], 0
je 0x10007507
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x10007507
mov ebx, dword [rbp]
add rbx, rdi
cmp qword [rbx], 0
je 0x10007455
nop
nop
mov rcx, qword [rbx]
movabs rax, 0x8000000000000000
test rax, rcx
jne 0x10007429
lea rdx, [rcx + rdi + 2]
jmp 0x1000742c
movzx edx, cx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x10007449
mov qword [rbx], rax
add rbx, 8
cmp qword [rbx], 0
jne 0x10007410
jmp 0x10007455
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r12d, r12d
add rbp, 0x14
cmp dword [rbp], 0
jne 0x100073d5
test r12d, r12d
je 0x10007507
mov r8d, dword [r14 + r13 + 0xb0]
add r8, rdi
cmp dword [r8], 0
je 0x100074ef
nop
mov eax, dword [r8 + 4]
test eax, eax
je 0x100074ef
add rax, 0xfffffffffffffff8
xor edx, edx
shr rax, 1
test eax, eax
movsxd r9, eax
jle 0x100074d9
nop
nop
movzx ecx, word [r8 + rdx*2 + 8]
mov eax, ecx
and ecx, 0xfff
shr eax, 0xc
cmp eax, 3
je 0x100074bb
cmp eax, 0xa
jne 0x100074d0
movsxd rax, ecx
mov ecx, dword [r8]
add rax, rdi
add rcx, rax
mov rax, rdi
sub rax, r15
add qword [rcx], rax
add rdx, 1
cmp rdx, r9
jl 0x100074a0
mov ecx, dword [r8 + 4]
lea rax, [rcx + rcx*2]
prefetcht1 byte [r8 + rax*2]
add r8, rcx
cmp dword [r8], 0
jne 0x10007480
mov eax, dword [r14 + r13 + 0x28]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
add rax, rdi
call rax
test eax, eax
jne 0x1000755c
mov rdx, qword [rsp + 0x20]
mov r8d, 0x4000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x90]
add rsp, 0x88
ret
mov rax, rdi
jmp 0x1000751d
xor eax, eax
jmp 0x10007542
xor eax, eax
jmp 0x10007547