Function at 0x140005ea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Inspect section memory permissions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x14007d2c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, qword [rcx + 0x18]
mov rbx, r8
mov r13, rcx
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov r14, rdx
mov r8d, dword [rbp + 0x54]
call fcn.140056bb0
xor r12d, r12d
mov esi, r12d
cmp r12w, word [rbp + 6]
jae 0x140005f22
mov rdi, qword [r13 + 0x40]
add rdi, 0x14
nop dword [rax]
mov edx, dword [rdi]
mov ecx, dword [rdi - 8]
add rdx, r14
mov r8d, dword [rdi - 4]
add rcx, rbx
call fcn.140056bb0
movzx eax, word [rbp + 6]
lea rdi, [rdi + 0x28]
inc esi
cmp esi, eax
jl 0x140005f00
mov rax, qword [r13 + 0x20]
mov r15d, r12d
mov qword [rsp + 0x80], rax
cmp dword [rax + 4], r12d
jbe 0x140005ff3
nop dword [rax + rax]
mov eax, dword [rax]
add rax, rbx
mov ecx, r15d
mov esi, dword [rcx + rax]
lea rdi, [rcx + rax]
test esi, esi
jne 0x140005f5c
cmp dword [rdi + 0x10], esi
je 0x140005ff0
mov ecx, dword [rcx + rax + 0xc]
mov r12d, dword [rdi + 0x10]
add rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
test rax, rax
je 0x14000623f
test esi, esi
jne 0x140005f80
mov esi, dword [rdi + 0x10]
cmp qword [rbx + r12], 0
mov r14d, esi
lea rsi, [rbx + r12]
lea rax, [rbx + r14]
je 0x140005fda
mov rdi, rsi
sub r14, r12
nop dword [rax + rax]
mov rax, qword [rax]
mov rcx, rbp
test rax, rax
jns 0x140005fb0
movzx edx, ax
jmp 0x140005fb7
lea rdx, [rbx + 2]
add rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000623f
add rdi, 8
mov qword [rsi], rax
mov rsi, rdi
cmp qword [rdi], 0
lea rax, [r14 + rdi]
jne 0x140005fa0
mov rax, qword [rsp + 0x80]
add r15d, 0x14
cmp r15d, dword [rax + 4]
jb 0x140005f40
xor r12d, r12d
mov rax, qword [r13 + 0x18]
cmp rbx, qword [rax + 0x30]
je 0x1400060ef
mov rax, qword [r13 + 0x30]
cmp dword [rax], 0
je 0x14000623f
mov r8d, dword [rax]
mov r11, rbx
mov rax, qword [r13 + 0x18]
add r8, rbx
sub r11, qword [rax + 0x30]
cmp dword [r8], 0
je 0x1400060ef
nop dword [rax]
mov eax, dword [r8 + 4]
lea r10, [r8 + 8]
add rax, r8
cmp r10, rax
je 0x1400060e2
nop dword [rax]
nop dword [rax + rax]
movzx r9d, word [r10]
mov eax, r9d
movzx edx, r9w
shr eax, 0xc
test eax, eax
je 0x1400060ce
sub eax, 1
je 0x1400060b5
sub eax, 1
je 0x1400060a1
sub eax, 1
je 0x14000608e
cmp eax, 7
jne 0x14000623f
mov ecx, dword [r8]
and r9d, 0xfff
lea rax, [rbx + r9]
add qword [rcx + rax], r11
jmp 0x1400060ce
mov ecx, dword [r8]
and edx, 0xfff
lea rax, [rbx + rdx]
add dword [rcx + rax], r11d
jmp 0x1400060ce
mov ecx, dword [r8]
and edx, 0xfff
lea rax, [rbx + rdx]
add word [rcx + rax], r11w
jmp 0x1400060ce
mov ecx, dword [r8]
and edx, 0xfff
add rdx, rbx
mov rax, r11
add rdx, rcx
shr rax, 0x10
add word [rdx], ax
mov eax, dword [r8 + 4]
add r10, 2
add rax, r8
cmp r10, rax
jne 0x140006050
cmp dword [r10], 0
mov r8, r10
jne 0x140006030
mov rdi, qword [r13 + 0x18]
cmp r12w, word [rdi + 6]
jae 0x1400061d5
mov rsi, qword [r13 + 0x40]
mov ebp, 2
mov r13d, 0x80
mov r14d, 4
mov r15d, 0x10
mov r9d, 0x20
mov r10d, 0x40
nop word [rax + rax]
lea rcx, [r12 + r12*4]
mov edx, dword [rsi + rcx*8 + 0x24]
mov r8d, edx
sar r8d, 0x1f
lea rcx, [r12 + r12*4]
and r8d, 8
mov eax, edx
bt edx, 0x1e
cmovb r8d, ebp
and eax, 0xc0000000
cmp eax, 0xc0000000
mov eax, edx
cmove r8d, r14d
bt edx, 0x1d
cmovb r8d, r15d
and eax, 0xa0000000
cmp eax, 0xa0000000
mov eax, edx
cmove r8d, r13d
and eax, 0x60000000
cmp eax, 0x60000000
cmove r8d, r9d
and edx, 0xe0000000
cmp edx, 0xe0000000
lea r9, [rsp + 0x80]
mov edx, dword [rsi + rcx*8 + 0x10]
lea rcx, [r12 + r12*4]
mov ecx, dword [rsi + rcx*8 + 0xc]
cmove r8d, r10d
add rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, word [rdi + 6]
inc r12d
mov r9d, 0x20
mov r10d, 0x40
cmp r12d, eax
jb 0x140006130
mov r13, qword [rsp + 0x20]
mov rax, qword [r13 + 0x28]
cmp dword [rax + 4], 0
je 0x14000620a
mov eax, dword [rax]
mov rdi, qword [rax + rbx + 0x18]
mov rax, qword [rdi]
test rax, rax
je 0x14000620a
nop
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call rax
mov rax, qword [rdi + 8]
lea rdi, [rdi + 8]
test rax, rax
jne 0x1400061f0
mov rax, qword [r13 + 0x18]
mov eax, dword [rax + 0x28]
add rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140029720
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x140006214