Function at 0x14000df00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm6
mov rax, qword [0x140043010]
xor rax, rsp
mov qword [rsp + 0x238], rax
cmp qword [rcx + 0x10], 0
je 0x14000e802
mov r13, rcx
mov qword [rsp + 0xa8], 0
mov ecx, 0x40
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0xa0], rax
mov rbx, qword [r13 + 8]
mov rbp, qword [rbx]
cmp rbp, rbx
mov qword [rsp + 0x60], r13
je 0x14000e62b
xor edi, edi
mov eax, dword [rbp + 0x10]
cmp eax, 2
jb 0x14000df92
cmp eax, 5
jle 0x14000e6cc
mov rbp, qword [rbp]
cmp rbp, rbx
jne 0x14000df81
mov rsi, qword [rsp + 0xa0]
mov rdx, qword [rsi + 8]
test rdi, rdi
je 0x14000e631
add rdi, 0xc
lea rbx, [rsp + 0xa0]
mov rcx, rbx
call fcn.1400119b0
mov rax, qword [rbx]
mov qword [rax + 8], rsi
mov qword [rax], rsi
mov rcx, qword [rbx]
mov qword [rbx + 8], 0
mov edx, 0x40
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov rcx, rdi
call sub.mozglue.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov r15, rax
test rdi, rdi
mov qword [rsp + 0x58], rax
jne 0x14000e809
mov rax, qword [r13]
mov rcx, qword [rax]
lea r9, [rsp + 0x90]
mov rdx, r15
mov r8, rdi
call fcn.14000f020
test al, al
je 0x14000e9ef
cmp qword [r13 + 0x10], 0
je 0x14000e5c7
mov rax, qword [r13]
mov r12, qword [rax]
mov dword [rsp + 0x20], 1
mov r8d, 0x10000
mov rcx, r12
xor edx, edx
mov r9d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
mov rbx, qword [r13 + 0x10]
shl rbx, 6
lea rax, [rbx + 0x60]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x70], rax
cmp rax, 0x10001
jae 0x14000e9f9
lea rbp, [rsp + 0x100]
mov rcx, rbp
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
movzx ecx, word [rsp + 0x100]
mov dword [rsp + 0x100], ecx
mov rax, qword [rsp + 0xa0]
mov edx, 0x10000
sub rdx, rax
cmp rdx, rcx
jb 0x14000e07f
mov edi, ecx
mov ebp, 0x800
mov ecx, 0x1000
mov edx, 0x800
mov rsi, rcx
shr rdx, 1
mov rcx, rbp
cmp rbp, rax
mov rbp, rdx
jae 0x14000e0c1
neg esi
and edi, esi
mov eax, edi
and eax, 0xf000
add r14, rax
add rbx, 0x105f
and rbx, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, r12
mov rdx, r14
mov r8, rbx
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000ea4a
mov qword [rsp + 0x78], r12
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xb8], 0
mov qword [rsp + 0xa8], 0x20
lea rcx, [sym.plugin_container.exe_g_originals]
xor r14d, r14d
mov r8d, 0x150
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x14003a5b0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14000ea7b
and edi, 0xfff
add qword [rsp + 0x68], rdi
mov rax, qword [r13]
mov r15, qword [rax + 0x48]
mov rcx, qword [rax + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
mov ecx, 0x30
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r12, rax
mov al, byte [r13 + 0x19]
mov rcx, qword [r13]
mov rcx, qword [rcx]
lea rdx, [0x14003a5d0]
mov qword [r12], rdx
mov qword [r12 + 0x18], 0
mov qword [r12 + 0x20], rcx
mov byte [r12 + 0x28], al
mov dword [r12 + 0x2c], 0
mov rdi, qword [r13 + 8]
mov r13d, 0x20
mov qword [rsp + 0x88], rdi
mov rdi, qword [rdi]
cmp rdi, qword [rsp + 0x88]
je 0x14000e4fa
lea rdx, [rdi + 0x10]
lea rcx, [rsp + 0x100]
call fcn.140008f90
mov qword [rsp + 0x228], 0
mov qword [rsp + 0x230], 7
mov word [rsp + 0x218], 0
mov edx, 9
lea rcx, [rsp + 0x218]
lea r9, [0x14003a5b0]
call fcn.14001e720
mov rax, qword [rsp + 0x228]
cmp qword [rsp + 0x118], rax
jne 0x14000e686
test rax, rax
je 0x14000e2ae
cmp qword [rsp + 0x230], 8
lea rcx, [rsp + 0x218]
jb 0x14000e27b
mov rcx, qword [rsp + 0x218]
cmp qword [rsp + 0x120], 8
lea rdx, [rsp + 0x108]
jb 0x14000e296
mov rdx, qword [rsp + 0x108]
xor ebp, ebp
movzx ebx, word [rdx + rbp*2]
cmp bx, word [rcx + rbp*2]
jne 0x14000e686
inc rbp
cmp rax, rbp
jne 0x14000e298
cmp dword [rsp + 0x100], 1
jne 0x14000e686
mov rcx, qword [rsp + 0x168]
test rcx, rcx
jne 0x14000e31e
cmp qword [rsp + 0x160], 0x10
lea r8, [rsp + 0x148]
jb 0x14000e2e4
mov r8, qword [rsp + 0x148]
mov rax, qword [r12]
mov rax, qword [rax + 0x10]
mov rcx, r12
mov rdx, rsi
lea r9, [rsp + 0x98]
call qword [case.0x14001ca4e.0]
test eax, eax
js 0x14000e695
mov rcx, qword [rsp + 0x98]
sub rcx, rsi
add rcx, r15
mov qword [rsp + 0x168], rcx
cmp qword [rsp + 0x160], 0x10
lea rdx, [rsp + 0x148]
jb 0x14000e339
mov rdx, qword [rsp + 0x148]
movsxd rax, r14d
shl rax, 6
mov rbp, qword [rsp + 0x70]
sub rbp, r13
cmp qword [rsp + 0x140], 0x10
lea r9, [rsp + 0x128]
jb 0x14000e363
mov r9, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x68]
add rbx, rax
add rbx, 0x20
mov rax, qword [r12]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x40], 0
mov rcx, r12
mov rdx, qword [rsp + 0x80]
mov r8, r15
call qword [case.0x14001ca4e.0]
test eax, eax
js 0x14000e6ae
movsxd rax, dword [rsp + 0x104]
lea rcx, [sym.plugin_container.exe_g_originals]
mov qword [rcx + rax*8], rbx
inc r14d
mov dword [rsp + 0xb8], r14d
add r13, 0x40
mov qword [rsp + 0xa8], r13
mov bl, 1
mov rax, qword [rsp + 0x230]
cmp rax, 8
jae 0x14000e469
mov rax, qword [rsp + 0x160]
cmp rax, 0x10
jae 0x14000e4b4
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x160], 0xf
mov byte [rsp + 0x148], 0
mov rax, qword [rsp + 0x140]
cmp rax, 0x10
jae 0x14000e4d7
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], 0
mov rax, qword [rsp + 0x120]
cmp rax, 8
jae 0x14000e490
test bl, bl
jne 0x14000e1e8
jmp 0x14000e502
mov rcx, qword [rsp + 0x218]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14000e638
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000e3ea
mov rcx, qword [rsp + 0x108]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14000e65f
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000e45c
mov rcx, qword [rsp + 0x148]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000e7bc
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000e3fc
mov rcx, qword [rsp + 0x128]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x14000e7dc
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000e42e
mov dword [rsp + 0x54], 0
mov rax, qword [r12]
mov rax, qword [rax]
mov rcx, r12
mov edx, 1
call qword [case.0x14001ca4e.0]
test rsi, rsi
je 0x14000e525
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [rsp + 0x54]
test edi, edi
mov r13, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x78]
jne 0x14000e5f5
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0xa0]
mov r9d, 0x20
mov rcx, rsi
mov rdx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000e72b
cmp qword [rsp + 0x100], 0x20
jne 0x14000e72b
lea rax, [rsp + 0x218]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [r13]
lea rdx, str.g_originals
lea r8, [sym.plugin_container.exe_g_originals]
mov r9d, 0x150
call fcn.1400088b0
test eax, eax
jne 0x14000e5f3
mov rax, qword [rsp + 0x90]
mov qword [sym.plugin_container.exe_g_interceptions], rax
lea r8, [sym.plugin_container.exe_g_interceptions]
mov rcx, qword [r13]
lea rdx, str.g_interceptions
mov r9d, 8
call fcn.1400088b0
mov edi, eax
mov rcx, r15
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.14001d580
mov eax, edi
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, rax
mov rdx, rax
xor edi, edi
jmp 0x14000dfb4
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e7fc
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
jmp 0x14000e486
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e7fc
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
jmp 0x14000e4ad
xor ebx, ebx
mov dword [rsp + 0x54], 2
jmp 0x14000e3dc
mov ecx, eax
call fcn.140038620
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x54], 0x29
jmp 0x14000e6c5
mov ecx, eax
call fcn.140038620
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x54], 0x28
xor ebx, ebx
jmp 0x14000e3dc
lea r14, [rsp + 0x100]
mov qword [r14 + 0x10], 0
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea rdx, [0x14003a5b0]
mov rcx, r14
call fcn.14000c460
mov r8, qword [rbp + 0x28]
cmp qword [r14 + 0x10], r8
jne 0x14000eb33
test r8, r8
je 0x14000e719
cmp qword [rbp + 0x30], 8
jb 0x14000e735
mov rcx, qword [rbp + 0x18]
jmp 0x14000e739
lea rcx, [rsp + 0x100]
call fcn.140017ce0
jmp 0x14000e7b2
mov edi, 0x2a
jmp 0x14000e5f5
lea rcx, [rbp + 0x18]
cmp qword [rsp + 0x118], 8
jb 0x14000e74c
mov r14, qword [rsp + 0x100]
dec r8
xor edx, edx
movzx r15d, word [r14 + rdx*2]
movzx esi, word [rcx + rdx*2]
cmp r15w, si
jne 0x14000e76c
lea rax, [rdx + 1]
cmp r8, rdx
mov rdx, rax
jne 0x14000e751
lea rcx, [rsp + 0x100]
call fcn.140017ce0
cmp r15w, si
je 0x14000e7b2
lea rsi, [rbp + 0x18]
lea rcx, [rsp + 0xa0]
mov rdx, rsi
call fcn.14002a6c0
test rax, rax
je 0x14000eb5c
mov rax, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
add rax, rcx
add rax, 0x21
and rax, 0xfffffffffffffff8
add rdi, rax
mov r13, qword [rsp + 0x60]
jmp 0x14000df92
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14000e7fc
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000e4cd
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14000e7fc
add rax, 0x28
mov rdx, rax
mov rcx, rbp
jmp 0x14000e4f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xor edi, edi
jmp 0x14000e5fd
mov rax, r13
add r13, 8
add r15, 0xc
xor r12d, r12d
cmp byte [rax + 0x18], 0
je 0x14000eb2c
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 4], rax
lea rax, [rdi - 0xc]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x218], r15
mov rax, qword [r13]
mov rbp, qword [rax]
cmp rbp, rax
je 0x14000ea8a
xor r12d, r12d
xorps xmm6, xmm6
lea rcx, [rbp + 0x10]
call fcn.14002bab0
test al, al
jne 0x14000e87c
mov rbp, qword [rbp]
cmp rbp, qword [r13]
jne 0x14000e860
jmp 0x14000ea8a
lea rbx, [rbp + 0x18]
movups xmmword [rsp + 0x110], xmm6
lea rcx, [rsp + 0x100]
mov rdx, rbx
call fcn.1400197c0
mov rax, qword [rbp + 0x28]
add rax, rax
add rax, 0x1f
and rax, 0xfffffffffffffff8
mov rcx, qword [rsp + 0xa0]
sub rcx, rax
jb 0x14000eb45
mov qword [rsp + 0xa0], rcx
lea r14, [r15 + rax]
mov qword [rsp + 0x218], r14
cmp dword [rbp + 0x10], 5
sete byte [r15 + 0x14]
mov qword [r15], rax
mov qword [r15 + 8], rax
mov dword [r15 + 0x10], 0
lea rcx, [r15 + 0x16]
cmp qword [rbp + 0x30], 8
jb 0x14000e8f3
mov rbx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x28]
add r8, r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp + 0x28]
mov word [r15 + rax*2 + 0x16], 0
mov r8, qword [r13]
cmp rbp, r8
je 0x14000e9d7
mov r14, rbp
mov rcx, qword [rsp + 0x110]
cmp qword [r14 + 0x28], rcx
jne 0x14000e9c3
test rcx, rcx
je 0x14000e975
cmp qword [rsp + 0x118], 8
lea rdx, [rsp + 0x100]
jb 0x14000e950
mov rdx, qword [rsp + 0x100]
cmp qword [r14 + 0x30], 8
jb 0x14000e95d
mov rbx, qword [r14 + 0x18]
jmp 0x14000e961
lea rbx, [r14 + 0x18]
xor eax, eax
movzx esi, word [rbx + rax*2]
cmp si, word [rdx + rax*2]
jne 0x14000e9c3
inc rax
cmp rcx, rax
jne 0x14000e963
lea rcx, [r14 + 0x10]
lea rdx, [rsp + 0x218]
lea r8, [rsp + 0xa0]
mov r9, r15
call fcn.14002bb80
test al, al
je 0x14000eb45
cmp rbp, r14
jne 0x14000e9a2
mov rbp, qword [rbp]
mov rcx, r13
lea rdx, [rsp + 0x98]
mov r8, r14
call fcn.14002bc90
mov r14, qword [rsp + 0x98]
mov r8, qword [r13]
jmp 0x14000e9c6
mov r14, qword [r14]
cmp r14, r8
jne 0x14000e91e
mov r14, qword [rsp + 0x218]
inc r12d
lea rcx, [rsp + 0x100]
call fcn.140017ce0
mov r15, r14
jmp 0x14000e871
mov edi, 0x27
jmp 0x14000e5f5
lea rdx, [0x14003a598]
lea r8, str.size___kAllocGranularity
lea rcx, [rsp + 0xa0]
call fcn.140021ef0
test rax, rax
je 0x14000e077
lea rdx, str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
lea rbp, [rsp + 0x100]
mov rcx, rbp
mov r8d, 0x2b
mov r9, rax
call fcn.140020870
mov rcx, rbp
call fcn.1400208e0
jmp 0x14000e077
lea rdx, str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
lea r9, str.thunk_base
lea rsi, [rsp + 0x100]
mov rcx, rsi
mov r8d, 0x188
call fcn.140020820
mov rcx, rsi
call fcn.1400208e0
jmp 0x14000e119
mov edi, 7
mov r15, qword [rsp + 0x58]
jmp 0x14000e5f5
mov rdx, qword [rsp + 0x58]
mov dword [rdx], r12d
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rcx, qword [rax]
lea r9, [rsp + 0x90]
mov r8, rdi
call fcn.14000f020
test al, al
je 0x14000eb8e
test rdi, rdi
mov r13, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
je 0x14000e01e
lea rax, str.TargetNtMapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rsi, [0x14003a5b0]
lea r8, str.NtMapViewOfSection
mov rcx, r13
mov rdx, rsi
mov r9d, 1
call fcn.140008c70
lea rax, str.TargetNtUnmapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, str.NtUnmapViewOfSection
mov rcx, r13
mov rdx, rsi
mov r9d, 1
call fcn.140008c70
jmp 0x14000e029
xor eax, eax
jmp 0x14000e82d
lea rcx, [rsp + 0x100]
call fcn.140017ce0
jmp 0x14000e77f
lea rcx, [rsp + 0x100]
call fcn.140017ce0
mov edi, 0x26
jmp 0x14000ea80
mov rax, qword [rbp + 0x28]
add rax, rax
add rax, 0x1f
and rax, 0xfffffffffffffff8
add rdi, rax
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x100]
xor r8d, r8d
mov r9, rsi
call fcn.140029c40
jmp 0x14000e79c
mov edi, 0x27
jmp 0x14000ea80