Function at 0x410fbd
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
jmp 0x411057
mov rcx, qword [0x004297b0]
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
mov rax, qword [rax + 0x18]
cmp qword [rbp + 0x10], rax
jb 0x411053
mov rcx, qword [0x004297b0]
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
mov rcx, qword [rax + 0x18]
mov r8, qword [0x004297b0]
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, r8
mov rax, qword [rax + 0x20]
mov eax, dword [rax + 8]
mov eax, eax
add rax, rcx
cmp qword [rbp + 0x10], rax
jb 0x41126e
add dword [rbp - 4], 1
mov eax, dword [0x004297b8]
cmp dword [rbp - 4], eax
jl 0x410fd5
mov rcx, qword [rbp + 0x10]
call sym.__mingw_GetSectionForAddress
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x41108a
mov rdx, qword [rbp + 0x10]
lea rcx, str.Address__p_has_no_image_section
call sym.__report_error
mov rcx, qword [0x004297b0]
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
lea rdx, [rcx + rax]
mov rax, qword [rbp - 0x10]
mov qword [rdx + 0x20], rax
mov rcx, qword [0x004297b0]
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
mov dword [rax], 0
call sym._GetPEImageBase
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0xc]
mov r9d, eax
mov r8, qword [0x004297b0]
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, r8
lea rdx, [rcx + r9]
mov qword [rax + 0x18], rdx
mov rcx, qword [0x004297b0]
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
mov rax, qword [rax + 0x18]
lea rdx, [rbp - 0x40]
mov r8d, 0x30
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualQuery]
call rax
test rax, rax
jne 0x411184
mov rcx, qword [0x004297b0]
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
mov rdx, qword [rax + 0x18]
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 8]
mov r8, rdx
mov edx, eax
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
call sym.__report_error
mov eax, dword [rbp - 0x1c]
cmp eax, 0x40
je 0x41125d
mov eax, dword [rbp - 0x1c]
cmp eax, 4
je 0x41125d
mov eax, dword [rbp - 0x1c]
cmp eax, 0x80
je 0x41125d
mov eax, dword [rbp - 0x1c]
cmp eax, 8
je 0x41125d
mov rcx, qword [0x004297b0]
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
lea rdx, [rcx + rax]
mov rax, qword [rbp - 0x40]
mov qword [rdx + 8], rax
mov rcx, qword [0x004297b0]
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
lea rdx, [rcx + rax]
mov rax, qword [rbp - 0x28]
mov qword [rdx + 0x10], rax
mov rcx, qword [0x004297b0]
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
mov rcx, rax
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x40]
mov r9, rcx
mov r8d, 0x40
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
jne 0x41125d
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
call sym.__report_error
mov eax, dword [0x004297b8]
add eax, 1
mov dword [0x004297b8], eax
jmp 0x41126f
nop
add rsp, 0x60
pop rbp
ret